{"id":"8289bf8c-4aca-4f5a-9db3-dc3d7afe5c10","title":"Unsigned Binary Loaded From Suspicious Location","description":"Detects Code Integrity (CI) engine blocking processes from loading unsigned DLLs residing in suspicious locations","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-08-03","modified":"2022-09-28","tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.stealth","attack.t1574.001"],"technique_ids":["T1574.001"],"logsource":{"product":"windows","service":"security-mitigations"},"falsepositives":["Unknown"],"references":["https://github.com/nasbench/EVTX-ETW-Resources/blob/45fd5be71a51aa518b1b36d4e1f36af498084e27/ETWEventsList/CSV/Windows11/21H2/W11_21H2_Pro_20220719_22000.795/Providers/Microsoft-Windows-Security-Mitigations.csv"],"source_path":"rules/windows/builtin/security_mitigations/win_security_mitigations_unsigned_dll_from_susp_location.yml","source_sha256":"359c04b0b09e0abab06bfd0520e89186af7d490f1eb156834d135e0ee2c35dab","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security_mitigations/win_security_mitigations_unsigned_dll_from_susp_location.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Unsigned Binary Loaded From Suspicious Location\nid: 8289bf8c-4aca-4f5a-9db3-dc3d7afe5c10\nstatus: test\ndescription: Detects Code Integrity (CI) engine blocking processes from loading unsigned DLLs residing in suspicious locations\nreferences:\n    - https://github.com/nasbench/EVTX-ETW-Resources/blob/45fd5be71a51aa518b1b36d4e1f36af498084e27/ETWEventsList/CSV/Windows11/21H2/W11_21H2_Pro_20220719_22000.795/Providers/Microsoft-Windows-Security-Mitigations.csv\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-08-03\nmodified: 2022-09-28\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.execution\n    - attack.stealth\n    - attack.t1574.001\nlogsource:\n    product: windows\n    service: security-mitigations\ndetection:\n    selection:\n        EventID:\n            - 11\n            - 12\n        ImageName|contains:\n            - '\\Users\\Public\\'\n            - '\\PerfLogs\\'\n            - '\\Desktop\\'\n            - '\\Downloads\\'\n            - '\\AppData\\Local\\Temp\\'\n            - 'C:\\Windows\\TEMP\\'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1574.001","id":"T1574.001","name":"DLL","page":"techniques/enterprise/T1574.001/"}],"data_path":"data/detection-rules/8289bf8c-4aca-4f5a-9db3-dc3d7afe5c10.json","kind":"sigma"}