{"id":"b8fd0e93-ff58-4cbd-8f48-1c114e342e62","title":"Windows Binaries Write Suspicious Extensions","description":"Detects Windows executables that write files with suspicious extensions","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-08-12","modified":"2025-10-07","tags":["attack.stealth","attack.t1036"],"technique_ids":["T1036"],"logsource":{"category":"file_event","product":"windows"},"falsepositives":["Unknown"],"references":["Internal Research"],"source_path":"rules/windows/file/file_event/file_event_win_shell_write_susp_files_extensions.yml","source_sha256":"e76229c800add301cb3b1ef3a70276ad42c8980c2cbdc1d36e6bebc22dbfcf40","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_shell_write_susp_files_extensions.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Windows Binaries Write Suspicious Extensions\nid: b8fd0e93-ff58-4cbd-8f48-1c114e342e62\nrelated:\n    - id: 1277f594-a7d1-4f28-a2d3-73af5cbeab43\n      type: derived\nstatus: test\ndescription: Detects Windows executables that write files with suspicious extensions\nreferences:\n    - Internal Research\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-08-12\nmodified: 2025-10-07\ntags:\n    - attack.stealth\n    - attack.t1036\nlogsource:\n    category: file_event\n    product: windows\ndetection:\n    selection_generic:\n        Image|endswith:\n            - '\\csrss.exe'\n            - '\\lsass.exe'\n            - '\\RuntimeBroker.exe'\n            - '\\sihost.exe'\n            - '\\smss.exe'\n            - '\\wininit.exe'\n            - '\\winlogon.exe'\n        TargetFilename|endswith:\n            - '.bat'\n            - '.dll'\n            - '.exe'\n            - '.hta'\n            - '.iso'\n            - '.ps1'\n            - '.txt'\n            - '.vbe'\n            - '.vbs'\n    selection_special:\n        Image|endswith:\n            - '\\dllhost.exe'\n            - '\\rundll32.exe'\n            - '\\svchost.exe'\n        TargetFilename|endswith:\n            - '.bat'\n            - '.hta'\n            - '.iso'\n            - '.ps1'\n            - '.vbe'\n            - '.vbs'\n    filter_main_AppLockerPolicyTest:\n        Image: 'C:\\Windows\\System32\\dllhost.exe'\n        TargetFilename|contains|all:\n            - ':\\Users\\'\n            - '\\AppData\\Local\\Temp\\__PSScriptPolicyTest_'\n        TargetFilename|endswith: '.ps1'\n    filter_main_script_gpo_machine:\n        Image: 'C:\\Windows\\system32\\svchost.exe'\n        TargetFilename|contains|all:\n            - 'C:\\Windows\\System32\\GroupPolicy\\DataStore\\'\n            - '\\sysvol\\'\n            - '\\Policies\\'\n            - '\\Machine\\Scripts\\Startup\\'\n        TargetFilename|endswith:\n            - '.ps1'\n            - '.bat'\n    filter_main_clipchamp:\n        Image: 'C:\\Windows\\system32\\svchost.exe'\n        TargetFilename|contains|all:\n            - 'C:\\Program Files\\WindowsApps\\Clipchamp'\n            - '.ps1'\n    filter_main_powershell_preview:\n        Image:\n            - 'C:\\Windows\\system32\\svchost.exe'\n            - 'C:\\Windows\\SysWOW64\\svchost.exe'\n        TargetFilename|startswith:\n            - 'C:\\Program Files\\WindowsApps\\Microsoft.PowerShellPreview'\n            - 'C:\\Program Files (x86)\\WindowsApps\\Microsoft.PowerShellPreview'\n        TargetFilename|endswith: '.ps1'\n    condition: 1 of selection_* and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036","id":"T1036","name":"Masquerading","page":"techniques/enterprise/T1036/"}],"data_path":"data/detection-rules/b8fd0e93-ff58-4cbd-8f48-1c114e342e62.json","kind":"sigma"}