{"id":"1cf465a1-2609-4c15-9b66-c32dbe4bfd67","title":"Legitimate Application Writing Files In Uncommon Location","description":"Detects legitimate applications writing any type of file to uncommon or suspicious locations that are not typical for application data storage or execution.\nAdversaries may leverage legitimate applications (Living off the Land Binaries - LOLBins) to drop or download malicious files to uncommon locations on the system to evade detection by security solutions.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-12-10","modified":"","tags":["attack.stealth","attack.t1218","attack.command-and-control","attack.t1105"],"technique_ids":["T1105","T1218"],"logsource":{"product":"windows","category":"file_event"},"falsepositives":["Unknown"],"references":["https://lolbas-project.github.io/#/download"],"source_path":"rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_in_uncommon_location.yml","source_sha256":"83744355b69976e8b4cfd62b1f3b993f4eee5a9aea7e2233de9564bb5a16963b","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_in_uncommon_location.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Legitimate Application Writing Files In Uncommon Location\nid: 1cf465a1-2609-4c15-9b66-c32dbe4bfd67\nrelated:\n    - id: 2ddef153-167b-4e89-86b6-757a9e65dcac # bitsadmin dedicated rule\n      type: similar\nstatus: experimental\ndescription: |\n    Detects legitimate applications writing any type of file to uncommon or suspicious locations that are not typical for application data storage or execution.\n    Adversaries may leverage legitimate applications (Living off the Land Binaries - LOLBins) to drop or download malicious files to uncommon locations on the system to evade detection by security solutions.\nreferences:\n    - https://lolbas-project.github.io/#/download\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-12-10\ntags:\n    - attack.stealth\n    - attack.t1218\n    - attack.command-and-control\n    - attack.t1105\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    selection_img:\n        Image|endswith:\n            # Microsoft Office Programs Dropping Executables / Rest of the apps are covered in: c7a74c80-ba5a-486e-9974-ab9e682bc5e4\n            - '\\eqnedt32.exe'\n            - '\\wordpad.exe'\n            - '\\wordview.exe'\n            # LOLBINs that can be used to download executables\n            - '\\cmdl32.exe'\n            - '\\certutil.exe'\n            - '\\certoc.exe'\n            - '\\CertReq.exe'\n            - '\\bitsadmin.exe'\n            - '\\Desktopimgdownldr.exe'\n            - '\\esentutl.exe'\n            - '\\expand.exe'\n            - '\\extrac32.exe'\n            - '\\replace.exe'\n            - '\\mshta.exe'\n            - '\\ftp.exe'\n            - '\\Ldifde.exe'\n            - '\\RdrCEF.exe'\n            - '\\hh.exe'\n            - '\\finger.exe'\n            - '\\findstr.exe'\n    selection_locations:\n        TargetFilename|contains:\n            - ':\\Perflogs'\n            - ':\\ProgramData\\'\n            - ':\\Temp\\'\n            - ':\\Users\\Public\\'\n            - ':\\Windows\\'\n            - '\\$Recycle.Bin\\'\n            - '\\AppData\\Local\\'\n            - '\\AppData\\Roaming\\'\n            - '\\Contacts\\'\n            - '\\Desktop\\'\n            - '\\Favorites\\'\n            - '\\Favourites\\'\n            - '\\inetpub\\wwwroot\\'\n            - '\\Music\\'\n            - '\\Pictures\\'\n            - '\\Start Menu\\Programs\\Startup\\'\n            - '\\Users\\Default\\'\n            - '\\Videos\\'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\nregression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_in_uncommon_location/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","page":"techniques/enterprise/T1105/"},{"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","page":"techniques/enterprise/T1218/"}],"data_path":"data/detection-rules/1cf465a1-2609-4c15-9b66-c32dbe4bfd67.json","kind":"sigma"}