Windows: Xwizard.exe Execution from Non-Default Directory

Alerts when Xwizard.exe starts from an unexpected Windows path, indicating potential misuse or side-loading.

FreeUnreviewedSigmahighv1

windows-xwizard-exe-execution-from-non-default-directory-193d5ccd

title: "Windows: Xwizard.exe Execution from Non-Default Directory"
id: 21251773-b1b7-4f64-9904-aaad48bd858a
status: test
description: This rule flags process creation where Xwizard.exe is run from a directory outside the standard Windows locations (System32, SysWOW64, or WinSxS). Attackers may use this behavior to run the tool from an unexpected path, which can support malicious side-loading or other stealthy execution workflows. It relies on Windows process creation telemetry fields for Image (path/filename) and OriginalFileName to identify Xwizard.exe and apply the location exclusions.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Xwizard/
  - http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_xwizard_execution_non_default_location.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-09-20
modified: 2024-08-15
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \xwizard.exe
    - OriginalFileName: xwizard.exe
  filter_main_legit_location:
    Image|startswith:
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
      - C:\Windows\WinSxS\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Windows installed on non-C drive
level: high
license: DRL-1.1
related:
  - id: 193d5ccd-6f59-40c6-b5b0-8e32d5ddd3d1
    type: derived

What it detects

This rule flags process creation where Xwizard.exe is run from a directory outside the standard Windows locations (System32, SysWOW64, or WinSxS). Attackers may use this behavior to run the tool from an unexpected path, which can support malicious side-loading or other stealthy execution workflows. It relies on Windows process creation telemetry fields for Image (path/filename) and OriginalFileName to identify Xwizard.exe and apply the location exclusions.

Known false positives

Windows installed on non-C drive

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.