Windows: Suspicious Service Binary Executed from Public/System Directories

title: "Windows: Suspicious Service Binary Executed from Public/System Directories"
id: d85e1419-6759-4b51-962d-3f0b373b98e4
status: test
description: This rule flags Windows process creations where the Image path contains common public, default, cache-like, or system-writable locations (for example, Users\Public, $Recycle.bin, C:\Perflogs, Fonts, IME, addins, or config\systemprofile) while the parent process ends with services.exe or svchost.exe. Attackers may use these directories to stage or hide malicious service payloads launched by Windows service host mechanisms. Telemetry required is Windows process creation events that provide both the full Image path and the ParentImage path for the process.
references:
  - https://blog.truesec.com/2021/03/07/exchange-zero-day-proxylogon-and-hafnium/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_service_dir.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-03-09
modified: 2022-10-09
tags:
  - attack.stealth
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - \Users\Public\
      - \$Recycle.bin
      - \Users\All Users\
      - \Users\Default\
      - \Users\Contacts\
      - \Users\Searches\
      - C:\Perflogs\
      - \config\systemprofile\
      - \Windows\Fonts\
      - \Windows\IME\
      - \Windows\addins\
    ParentImage|endswith:
      - \services.exe
      - \svchost.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 883faa95-175a-4e22-8181-e5761aeb373c
    type: derived