{"id":"193d5ccd-6f59-40c6-b5b0-8e32d5ddd3d1","title":"Xwizard.EXE Execution From Non-Default Location","description":"Detects the execution of Xwizard tool from a non-default directory.\nWhen executed from a non-default directory, this utility can be abused in order to side load a custom version of \"xwizards.dll\".\n","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-09-20","modified":"2024-08-15","tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.stealth","attack.t1574.001"],"technique_ids":["T1574.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Windows installed on non-C drive"],"references":["https://lolbas-project.github.io/lolbas/Binaries/Xwizard/","http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/"],"source_path":"rules/windows/process_creation/proc_creation_win_xwizard_execution_non_default_location.yml","source_sha256":"76b1f26a5033aa03d9c1130ce14b20d4582b11464d8938fbcafc402531d23fd0","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_xwizard_execution_non_default_location.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Xwizard.EXE Execution From Non-Default Location\nid: 193d5ccd-6f59-40c6-b5b0-8e32d5ddd3d1\nstatus: test\ndescription: |\n    Detects the execution of Xwizard tool from a non-default directory.\n    When executed from a non-default directory, this utility can be abused in order to side load a custom version of \"xwizards.dll\".\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Xwizard/\n    - http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/\nauthor: Christian Burkard (Nextron Systems)\ndate: 2021-09-20\nmodified: 2024-08-15\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.execution\n    - attack.stealth\n    - attack.t1574.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\xwizard.exe'\n        - OriginalFileName: 'xwizard.exe'\n    filter_main_legit_location:\n        Image|startswith:\n            - 'C:\\Windows\\System32\\'\n            - 'C:\\Windows\\SysWOW64\\'\n            - 'C:\\Windows\\WinSxS\\'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Windows installed on non-C drive\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1574.001","id":"T1574.001","name":"DLL","page":"techniques/enterprise/T1574.001/"}],"data_path":"data/detection-rules/193d5ccd-6f59-40c6-b5b0-8e32d5ddd3d1.json","kind":"sigma"}