{"id":"d5866ddf-ce8f-4aea-b28e-d96485a20d3d","title":"Files With System Process Name In Unsuspected Locations","description":"Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.).\nIt is highly recommended to perform an initial baseline before using this rule in production.\n","author":"Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2020-05-26","modified":"2026-02-04","tags":["attack.stealth","attack.t1036.005"],"technique_ids":["T1036.005"],"logsource":{"category":"file_event","product":"windows"},"falsepositives":["System processes copied outside their default folders for testing purposes","Third party software naming their software with the same names as the processes mentioned here"],"references":["Internal Research"],"source_path":"rules/windows/file/file_event/file_event_win_creation_system_file.yml","source_sha256":"a27d7a59a4e852a95784333dc29367ea5d6214ff3b9da016e32ee9e31d4215e5","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_creation_system_file.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Files With System Process Name In Unsuspected Locations\nid: d5866ddf-ce8f-4aea-b28e-d96485a20d3d\nstatus: test\ndescription: |\n    Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.).\n    It is highly recommended to perform an initial baseline before using this rule in production.\nreferences:\n    - Internal Research\nauthor: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)\ndate: 2020-05-26\nmodified: 2026-02-04\ntags:\n    - attack.stealth\n    - attack.t1036.005\nlogsource:\n    category: file_event\n    product: windows\ndetection:\n    selection:\n        TargetFilename|endswith:\n            - '\\AtBroker.exe'\n            - '\\audiodg.exe'\n            - '\\backgroundTaskHost.exe'\n            - '\\bcdedit.exe'\n            - '\\bitsadmin.exe'\n            - '\\cmdl32.exe'\n            - '\\cmstp.exe'\n            - '\\conhost.exe'\n            - '\\csrss.exe'\n            - '\\dasHost.exe'\n            - '\\dfrgui.exe'\n            - '\\dllhost.exe'\n            - '\\dwm.exe'\n            - '\\eventcreate.exe'\n            - '\\eventvwr.exe'\n            - '\\explorer.exe'\n            - '\\extrac32.exe'\n            - '\\fontdrvhost.exe'\n            - '\\fsquirt.exe' # was seen used by sidewinder APT - https://securelist.com/sidewinder-apt/114089/\n            - '\\ipconfig.exe'\n            - '\\iscsicli.exe'\n            - '\\iscsicpl.exe'\n            - '\\logman.exe'\n            - '\\LogonUI.exe'\n            - '\\LsaIso.exe'\n            - '\\lsass.exe'\n            - '\\lsm.exe'\n            - '\\msiexec.exe'\n            - '\\msinfo32.exe'\n            - '\\mstsc.exe'\n            - '\\nbtstat.exe'\n            - '\\odbcconf.exe'\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n            - '\\regini.exe'\n            - '\\regsvr32.exe'\n            - '\\rundll32.exe'\n            - '\\RuntimeBroker.exe'\n            - '\\schtasks.exe'\n            - '\\SearchFilterHost.exe'\n            - '\\SearchIndexer.exe'\n            - '\\SearchProtocolHost.exe'\n            - '\\SecurityHealthService.exe'\n            - '\\SecurityHealthSystray.exe'\n            - '\\services.exe'\n            - '\\ShellAppRuntime.exe'\n            - '\\sihost.exe'\n            - '\\smartscreen.exe'\n            - '\\smss.exe'\n            - '\\spoolsv.exe'\n            - '\\svchost.exe'\n            - '\\SystemSettingsBroker.exe'\n            - '\\taskhost.exe'\n            - '\\taskhostw.exe'\n            - '\\Taskmgr.exe'\n            - '\\TiWorker.exe'\n            - '\\vssadmin.exe'\n            - '\\w32tm.exe'\n            - '\\WerFault.exe'\n            - '\\WerFaultSecure.exe'\n            - '\\wermgr.exe'\n            - '\\wevtutil.exe'\n            - '\\wininit.exe'\n            - '\\winlogon.exe'\n            - '\\winrshost.exe'\n            - '\\WinRTNetMUAHostServer.exe'\n            - '\\wlanext.exe'\n            - '\\wlrmdr.exe'\n            - '\\WmiPrvSE.exe'\n            - '\\wslhost.exe'\n            - '\\WSReset.exe'\n            - '\\WUDFHost.exe'\n            - '\\WWAHost.exe'\n    filter_main_generic:\n        # Note: It is recommended to use a more robust filter instead of this generic one, to avoid false negatives.\n        TargetFilename|contains:\n            # - '\\SystemRoot\\System32\\'\n            - 'C:\\$WINDOWS.~BT\\'\n            - 'C:\\$WinREAgent\\'\n            - 'C:\\Windows\\SoftwareDistribution\\'\n            - 'C:\\Windows\\System32\\'\n            - 'C:\\Windows\\SysWOW64\\'\n            - 'C:\\Windows\\WinSxS\\'\n            - 'C:\\Windows\\uus\\'\n    filter_main_tiworker:\n        Image|endswith:\n            - '\\TiWorker.exe'\n            - '\\wuaucltcore.exe'\n        TargetFilename|startswith: 'C:\\Windows\\Temp\\'\n    filter_main_svchost:\n        Image|endswith:\n            - 'C:\\Windows\\system32\\svchost.exe'\n            - 'C:\\Windows\\SysWOW64\\svchost.exe'\n        TargetFilename|contains:\n            - 'C:\\Program Files\\WindowsApps\\'\n            - 'C:\\Program Files (x86)\\WindowsApps\\'\n            - '\\AppData\\Local\\Microsoft\\WindowsApps\\'\n    filter_main_wuauclt:\n        Image:\n            - 'C:\\Windows\\System32\\wuauclt.exe'\n            - 'C:\\Windows\\SysWOW64\\wuauclt.exe'\n            - 'C:\\Windows\\UUS\\arm64\\wuaucltcore.exe'\n    filter_main_explorer:\n        TargetFilename|endswith: 'C:\\Windows\\explorer.exe'\n    filter_main_msiexec:\n        # This filter handles system processes who are updated/installed using misexec.\n        Image|endswith:\n            - 'C:\\WINDOWS\\system32\\msiexec.exe'\n            - 'C:\\WINDOWS\\SysWOW64\\msiexec.exe'\n        # Add more processes if you find them or simply filter msiexec on its own. If the list grows big\n        TargetFilename|startswith:\n            - 'C:\\Program Files\\PowerShell\\7\\pwsh.exe'\n            - 'C:\\Program Files\\PowerShell\\7-preview\\pwsh.exe'\n            - 'C:\\Program Files\\WindowsApps\\Microsoft.PowerShellPreview\\'\n    filter_main_healtray:\n        TargetFilename|contains: 'C:\\Windows\\System32\\SecurityHealth\\'\n        TargetFilename|endswith: '\\SecurityHealthSystray.exe'\n        Image|endswith: '\\SecurityHealthSetup.exe'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - System processes copied outside their default folders for testing purposes\n    - Third party software naming their software with the same names as the processes mentioned here\n# Note: Upgrade to high after an initial baseline to your environement.\nlevel: medium\nregression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_creation_system_file/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036.005","id":"T1036.005","name":"Match Legitimate Resource Name or Location","page":"techniques/enterprise/T1036.005/"}],"data_path":"data/detection-rules/d5866ddf-ce8f-4aea-b28e-d96485a20d3d.json","kind":"sigma"}