Windows: WinSxS .exe Creation Triggered by Non-System Process
Flags .exe creation in C:\Windows\WinSxS\ when the creating process is not from standard system directories.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-11
- Updated
- 2026-07-31
What it detects
This rule flags file creation events where an executable (.exe) is written under the Windows WinSxS directory by a process whose image path is not in common system locations. Attackers may use WinSxS to blend in with legitimate Windows component structure, making malicious persistence or execution harder to spot. Detection relies on Windows file event telemetry containing TargetFilename and the creating process Image path.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-winsxs-exe-creation-by-non-system-processes-34746e8c
title: "Windows: WinSxS .exe Creation Triggered by Non-System Process"
id: d73acb67-97bd-464b-b1c5-e95ee7bd6522
related:
- id: 64827580-e4c3-4c64-97eb-c72325d45399
type: derived
- id: 34746e8c-5fb8-415a-b135-0abc167e912a
type: derived
status: test
description: This rule flags file creation events where an executable (.exe) is written under the Windows WinSxS directory by a process whose image path is not in common system locations. Attackers may use WinSxS to blend in with legitimate Windows component structure, making malicious persistence or execution harder to spot. Detection relies on Windows file event telemetry containing TargetFilename and the creating process Image path.
references:
- https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_winsxs_binary_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-11
tags:
- attack.execution
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|startswith: C:\Windows\WinSxS\
TargetFilename|endswith: .exe
filter_main_system_location:
Image|startswith:
- C:\Windows\Systems32\
- C:\Windows\SysWOW64\
- C:\Windows\WinSxS\
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1