Windows: Xwizard.exe Execution from Non-Default Directory
Alerts when Xwizard.exe starts from an unexpected Windows path, indicating potential misuse or side-loading.
- Product
- windows
- Category
- process_creation
- Author
- Christian Burkard (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-09-20
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation where Xwizard.exe is run from a directory outside the standard Windows locations (System32, SysWOW64, or WinSxS). Attackers may use this behavior to run the tool from an unexpected path, which can support malicious side-loading or other stealthy execution workflows. It relies on Windows process creation telemetry fields for Image (path/filename) and OriginalFileName to identify Xwizard.exe and apply the location exclusions.
Reporting behind it
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Xwizard/
- hexacorn.comhttp://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_xwizard_execution_non_default_location.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Xwizard.exe Execution from Non-Default Directory"
id: 21251773-b1b7-4f64-9904-aaad48bd858a
status: test
description: This rule flags process creation where Xwizard.exe is run from a directory outside the standard Windows locations (System32, SysWOW64, or WinSxS). Attackers may use this behavior to run the tool from an unexpected path, which can support malicious side-loading or other stealthy execution workflows. It relies on Windows process creation telemetry fields for Image (path/filename) and OriginalFileName to identify Xwizard.exe and apply the location exclusions.
references:
- https://lolbas-project.github.io/lolbas/Binaries/Xwizard/
- http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_xwizard_execution_non_default_location.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-09-20
modified: 2024-08-15
tags:
- attack.privilege-escalation
- attack.persistence
- attack.execution
- attack.stealth
- attack.t1574.001
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith: \xwizard.exe
- OriginalFileName: xwizard.exe
filter_main_legit_location:
Image|startswith:
- C:\Windows\System32\
- C:\Windows\SysWOW64\
- C:\Windows\WinSxS\
condition: selection and not 1 of filter_main_*
falsepositives:
- Windows installed on non-C drive
level: high
license: DRL-1.1
related:
- id: 193d5ccd-6f59-40c6-b5b0-8e32d5ddd3d1
type: derived