{"id":"15b75071-74cc-47e0-b4c6-b43744a62a2b","title":"Suspicious Process Start Locations","description":"Detects suspicious process run from unusual locations","author":"juju4, Jonhnathan Ribeiro, oscd.community","status":"test","level":"medium","date":"2019-01-16","modified":"2022-01-07","tags":["attack.stealth","attack.t1036","car.2013-05-002"],"technique_ids":["T1036"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["False positives depend on scripts and administrative tools used in the monitored environment"],"references":["https://car.mitre.org/wiki/CAR-2013-05-002"],"source_path":"rules/windows/process_creation/proc_creation_win_rundll32_run_locations.yml","source_sha256":"5f3cfd6e1f12e885f9625f7b925b6fb3524ab557951915029e728e1de75522be","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_rundll32_run_locations.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Process Start Locations\nid: 15b75071-74cc-47e0-b4c6-b43744a62a2b\nstatus: test\ndescription: Detects suspicious process run from unusual locations\nreferences:\n    - https://car.mitre.org/wiki/CAR-2013-05-002\nauthor: juju4, Jonhnathan Ribeiro, oscd.community\ndate: 2019-01-16\nmodified: 2022-01-07\ntags:\n    - attack.stealth\n    - attack.t1036\n    - car.2013-05-002\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|contains:\n              - ':\\RECYCLER\\'\n              - ':\\SystemVolumeInformation\\'\n        - Image|startswith:\n              - 'C:\\Windows\\Tasks\\'\n              - 'C:\\Windows\\debug\\'\n              - 'C:\\Windows\\fonts\\'\n              - 'C:\\Windows\\help\\'\n              - 'C:\\Windows\\drivers\\'\n              - 'C:\\Windows\\addins\\'\n              - 'C:\\Windows\\cursors\\'\n              - 'C:\\Windows\\system32\\tasks\\'\n    condition: selection\nfalsepositives:\n    - False positives depend on scripts and administrative tools used in the monitored environment\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036","id":"T1036","name":"Masquerading","page":"techniques/enterprise/T1036/"}],"data_path":"data/detection-rules/15b75071-74cc-47e0-b4c6-b43744a62a2b.json","kind":"sigma"}