{"id":"74babdd6-a758-4549-9632-26535279e654","title":"Suspicious Executable File Creation","description":"Detect creation of suspicious executable file names.\nSome strings look for suspicious file extensions, others look for filenames that exploit unquoted service paths.\n","author":"frack113","status":"test","level":"high","date":"2022-09-05","modified":"2023-12-11","tags":["attack.stealth","attack.t1564"],"technique_ids":["T1564"],"logsource":{"product":"windows","category":"file_event"},"falsepositives":["Unknown"],"references":["https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae","https://app.any.run/tasks/76c69e2d-01e8-49d9-9aea-fb7cc0c4d3ad/"],"source_path":"rules/windows/file/file_event/file_event_win_susp_executable_creation.yml","source_sha256":"e89919d07261efad01ca6c59ae52e6af19a5326d1ada3fdbd2e6503467400ee6","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_executable_creation.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Executable File Creation\nid: 74babdd6-a758-4549-9632-26535279e654\nstatus: test\ndescription: |\n    Detect creation of suspicious executable file names.\n    Some strings look for suspicious file extensions, others look for filenames that exploit unquoted service paths.\nreferences:\n    - https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae\n    - https://app.any.run/tasks/76c69e2d-01e8-49d9-9aea-fb7cc0c4d3ad/\nauthor: frack113\ndate: 2022-09-05\nmodified: 2023-12-11\ntags:\n    - attack.stealth\n    - attack.t1564\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    selection:\n        TargetFilename|endswith:\n            - ':\\$Recycle.Bin.exe'\n            - ':\\Documents and Settings.exe'\n            - ':\\MSOCache.exe'\n            - ':\\PerfLogs.exe'\n            - ':\\Recovery.exe'\n            - '.bat.exe'\n            - '.sys.exe'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1564","id":"T1564","name":"Hide Artifacts","page":"techniques/enterprise/T1564/"}],"data_path":"data/detection-rules/74babdd6-a758-4549-9632-26535279e654.json","kind":"sigma"}