{"id":"737e618a-a410-49b5-bec3-9e55ff7fbc15","title":"Suspicious Calculator Usage","description":"Detects suspicious use of 'calc.exe' with command line parameters or in a suspicious directory, which is likely caused by some PoC or detection evasion.\n","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-02-09","modified":"2023-11-09","tags":["attack.stealth","attack.t1036"],"technique_ids":["T1036"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://twitter.com/ItsReallyNick/status/1094080242686312448"],"source_path":"rules/windows/process_creation/proc_creation_win_calc_uncommon_exec.yml","source_sha256":"6a1e4072ed3e4c14c299ebd50ed210ab83b994b9d285d8b76ab786827c05c10f","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_calc_uncommon_exec.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Calculator Usage\nid: 737e618a-a410-49b5-bec3-9e55ff7fbc15\nstatus: test\ndescription: |\n    Detects suspicious use of 'calc.exe' with command line parameters or in a suspicious directory, which is likely caused by some PoC or detection evasion.\nreferences:\n    - https://twitter.com/ItsReallyNick/status/1094080242686312448\nauthor: Florian Roth (Nextron Systems)\ndate: 2019-02-09\nmodified: 2023-11-09\ntags:\n    - attack.stealth\n    - attack.t1036\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_1:\n        CommandLine|contains: '\\calc.exe '\n    selection_2:\n        Image|endswith: '\\calc.exe'\n    filter_main_known_locations:\n        Image|contains:\n            - ':\\Windows\\System32\\'\n            - ':\\Windows\\SysWOW64\\'\n            - ':\\Windows\\WinSxS\\'\n    condition: selection_1 or ( selection_2 and not filter_main_known_locations )\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036","id":"T1036","name":"Masquerading","page":"techniques/enterprise/T1036/"}],"data_path":"data/detection-rules/737e618a-a410-49b5-bec3-9e55ff7fbc15.json","kind":"sigma"}