Windows: Suspicious Script/Executable File Creation in Non-Standard AppData Paths

title: "Windows: Suspicious Script/Executable File Creation in Non-Standard AppData Paths"
id: 7cc942f9-b02d-455c-812b-1a4a1e00575c
status: test
description: This rule flags file creation events where the target path is within the user’s C:\Users\... and contains \AppData\ but excludes well-known AppData subdirectories (Local, LocalLow, and Roaming). Attackers may use uncommon AppData locations to blend in with user-writable areas and evade detections focused on standard folders. Telemetry required includes Windows file event logs that provide the created file path so the rule can match filename extensions and apply the AppData subdirectory exclusions.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_new_files_in_uncommon_appdata_folder.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-05
modified: 2023-02-23
tags:
  - attack.execution
  - attack.stealth
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|startswith: C:\Users\
    TargetFilename|contains: \AppData\
    TargetFilename|endswith:
      - .bat
      - .cmd
      - .cpl
      - .dll
      - .exe
      - .hta
      - .iso
      - .lnk
      - .msi
      - .ps1
      - .psm1
      - .scr
      - .vbe
      - .vbs
  filter_main:
    TargetFilename|startswith: C:\Users\
    TargetFilename|contains:
      - \AppData\Local\
      - \AppData\LocalLow\
      - \AppData\Roaming\
  condition: selection and not filter_main
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: d7b50671-d1ad-4871-aa60-5aa5b331fe04
    type: derived