{"id":"1277f594-a7d1-4f28-a2d3-73af5cbeab43","title":"Windows Shell/Scripting Application File Write to Suspicious Folder","description":"Detects Windows shells and scripting applications that write files to suspicious folders","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-11-20","modified":"2023-03-29","tags":["attack.execution","attack.t1059"],"technique_ids":["T1059"],"logsource":{"category":"file_event","product":"windows"},"falsepositives":["Unknown"],"references":["Internal Research"],"source_path":"rules/windows/file/file_event/file_event_win_shell_write_susp_directory.yml","source_sha256":"fbaac75b263855b77cfeff593a1b099159fc20d7b2417cf9a96463e8039d1c37","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_shell_write_susp_directory.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Windows Shell/Scripting Application File Write to Suspicious Folder\nid: 1277f594-a7d1-4f28-a2d3-73af5cbeab43\nstatus: test\ndescription: Detects Windows shells and scripting applications that write files to suspicious folders\nreferences:\n    - Internal Research\nauthor: Florian Roth (Nextron Systems)\ndate: 2021-11-20\nmodified: 2023-03-29\ntags:\n    - attack.execution\n    - attack.t1059\nlogsource:\n    category: file_event\n    product: windows\ndetection:\n    selection_1:\n        Image|endswith:\n            - '\\bash.exe'\n            - '\\cmd.exe'\n            - '\\cscript.exe'\n            - '\\msbuild.exe'  # https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n            - '\\sh.exe'\n            - '\\wscript.exe'\n        TargetFilename|startswith:\n            - 'C:\\PerfLogs\\'\n            - 'C:\\Users\\Public\\'\n    selection_2:\n        Image|endswith:\n            - '\\certutil.exe'\n            - '\\forfiles.exe'\n            - '\\mshta.exe'\n            # - '\\rundll32.exe' # Potential FP\n            - '\\schtasks.exe'\n            - '\\scriptrunner.exe'\n            - '\\wmic.exe'  # https://app.any.run/tasks/c903e9c8-0350-440c-8688-3881b556b8e0/\n        TargetFilename|contains:\n            - 'C:\\PerfLogs\\'\n            - 'C:\\Users\\Public\\'\n            - 'C:\\Windows\\Temp\\'\n    condition: 1 of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","page":"techniques/enterprise/T1059/"}],"data_path":"data/detection-rules/1277f594-a7d1-4f28-a2d3-73af5cbeab43.json","kind":"sigma"}