{"id":"7d604714-e071-49ff-8726-edeb95a70679","title":"Legitimate Application Dropped Script","description":"Detects programs on a Windows system that should not write scripts to disk","author":"frack113, Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-08-21","modified":"2023-06-22","tags":["attack.stealth","attack.t1218"],"technique_ids":["T1218"],"logsource":{"product":"windows","category":"file_event"},"falsepositives":["Unknown"],"references":["https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326"],"source_path":"rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_script.yml","source_sha256":"c67ce413622fc5feba663acd72cf9cf4e9d58afede3fbf0c266df416530bb460","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_script.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Legitimate Application Dropped Script\nid: 7d604714-e071-49ff-8726-edeb95a70679\nstatus: test\ndescription: Detects programs on a Windows system that should not write scripts to disk\nreferences:\n    - https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326\nauthor: frack113, Florian Roth (Nextron Systems)\ndate: 2022-08-21\nmodified: 2023-06-22\ntags:\n    - attack.stealth\n    - attack.t1218\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    selection:\n        Image|endswith:\n            # Microsoft Office Programs Dropping Executables / Rest of the apps are covered in: c7a74c80-ba5a-486e-9974-ab9e682bc5e4\n            - \\eqnedt32.exe\n            - \\wordpad.exe\n            - \\wordview.exe\n            # LOLBINs that can be used to download executables\n            - \\certutil.exe\n            - \\certoc.exe\n            - \\CertReq.exe\n            # - \\bitsadmin.exe (depends on the environment; comment in if you're sure that bitsadmin doesn't do that in your env)\n            - \\Desktopimgdownldr.exe\n            - \\esentutl.exe\n            # - \\expand.exe\n            - '\\mshta.exe'\n            # Executables that should never drop an executable to disk (but may after a previous process injection or if it's malware that uses a legitimate name)\n            - '\\AcroRd32.exe'\n            - '\\RdrCEF.exe'\n            - '\\hh.exe'\n            - '\\finger.exe'\n        TargetFilename|endswith:\n            - '.ps1'\n            - '.bat'\n            - '.vbs'\n            - '.scf'\n            - '.wsf'\n            - '.wsh'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","page":"techniques/enterprise/T1218/"}],"data_path":"data/detection-rules/7d604714-e071-49ff-8726-edeb95a70679.json","kind":"sigma"}