huntrule

Windows: WinSxS .exe creation by non-system processes

Flags .exe creation in C:\Windows\WinSxS\ when the creating process is not from standard system directories.

FreeUnreviewedSigmamediumv1
title: "Windows: WinSxS .exe creation by non-system processes"
id: d73acb67-97bd-464b-b1c5-e95ee7bd6522
related:
  - id: 64827580-e4c3-4c64-97eb-c72325d45399
    type: derived
  - id: 34746e8c-5fb8-415a-b135-0abc167e912a
    type: derived
status: test
description: This rule identifies file events where an .exe is created in the C:\Windows\WinSxS\ directory by a process whose image path is not in common system locations. Attackers may write executables into trusted Windows component directories to blend in and increase persistence or execution opportunities. The detection relies on file creation telemetry that includes the target filename and the creating process image path.
references:
  - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_winsxs_binary_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-11
tags:
  - attack.execution
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|startswith: C:\Windows\WinSxS\
    TargetFilename|endswith: .exe
  filter_main_system_location:
    Image|startswith:
      - C:\Windows\Systems32\
      - C:\Windows\SysWOW64\
      - C:\Windows\WinSxS\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule identifies file events where an .exe is created in the C:\Windows\WinSxS\ directory by a process whose image path is not in common system locations. Attackers may write executables into trusted Windows component directories to blend in and increase persistence or execution opportunities. The detection relies on file creation telemetry that includes the target filename and the creating process image path.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.