{"id":"69bd9b97-2be2-41b6-9816-fb08757a4d1a","title":"Potentially Suspicious Execution From Parent Process In Public Folder","description":"Detects a potentially suspicious execution of a parent process located in the \"\\Users\\Public\" folder executing a child process containing references to shell or scripting binaries and commandlines.\n","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-02-25","modified":"2024-07-12","tags":["attack.execution","attack.stealth","attack.t1564","attack.t1059"],"technique_ids":["T1059","T1564"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://redcanary.com/blog/blackbyte-ransomware/"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_execution_from_public_folder_as_parent.yml","source_sha256":"cbb3f8d69aae01fb7d80c8fae40bfc4ceeff20329e4ed0a01e6a231da8469eed","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_execution_from_public_folder_as_parent.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potentially Suspicious Execution From Parent Process In Public Folder\nid: 69bd9b97-2be2-41b6-9816-fb08757a4d1a\nstatus: test\ndescription: |\n    Detects a potentially suspicious execution of a parent process located in the \"\\Users\\Public\" folder executing a child process containing references to shell or scripting binaries and commandlines.\nreferences:\n    - https://redcanary.com/blog/blackbyte-ransomware/\nauthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-02-25\nmodified: 2024-07-12\ntags:\n    - attack.execution\n    - attack.stealth\n    - attack.t1564\n    - attack.t1059\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_parent:\n        ParentImage|contains: ':\\Users\\Public\\'\n    selection_child:\n        - Image|endswith:\n              - '\\bitsadmin.exe'\n              - '\\certutil.exe'\n              - '\\cmd.exe'\n              - '\\cscript.exe'\n              - '\\mshta.exe'\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n              - '\\regsvr32.exe'\n              - '\\rundll32.exe'\n              - '\\wscript.exe'\n        - CommandLine|contains:\n              - 'bitsadmin'\n              - 'certutil'\n              - 'cscript'\n              - 'mshta'\n              - 'powershell'\n              - 'regsvr32'\n              - 'rundll32'\n              - 'wscript'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","page":"techniques/enterprise/T1059/"},{"key":"enterprise/T1564","id":"T1564","name":"Hide Artifacts","page":"techniques/enterprise/T1564/"}],"data_path":"data/detection-rules/69bd9b97-2be2-41b6-9816-fb08757a4d1a.json","kind":"sigma"}