{"id":"e4a6b256-3e47-40fc-89d2-7a477edd6915","title":"System File Execution Location Anomaly","description":"Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location.\n","author":"Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2017-11-27","modified":"2026-02-12","tags":["attack.stealth","attack.t1036"],"technique_ids":["T1036"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://twitter.com/GelosSnake/status/934900723426439170","https://asec.ahnlab.com/en/39828/","https://www.splunk.com/en_us/blog/security/inno-setup-malware-redline-stealer-campaign.html"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_system_exe_anomaly.yml","source_sha256":"fc99cf970a0705bb3b9bc7826dbf133eda66d8bbaa093e52efd33234ef61a1e6","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_system_exe_anomaly.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: System File Execution Location Anomaly\nid: e4a6b256-3e47-40fc-89d2-7a477edd6915\nrelated:\n    - id: be58d2e2-06c8-4f58-b666-b99f6dc3b6cd # Dedicated SvcHost rule\n      type: derived\nstatus: test\ndescription: |\n    Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location.\nreferences:\n    - https://twitter.com/GelosSnake/status/934900723426439170\n    - https://asec.ahnlab.com/en/39828/\n    - https://www.splunk.com/en_us/blog/security/inno-setup-malware-redline-stealer-campaign.html\nauthor: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)\ndate: 2017-11-27\nmodified: 2026-02-12\ntags:\n    - attack.stealth\n    - attack.t1036\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith:\n            - '\\atbroker.exe'\n            - '\\audiodg.exe'\n            - '\\bcdedit.exe'\n            - '\\bitsadmin.exe'\n            - '\\certreq.exe'\n            - '\\certutil.exe'\n            - '\\cmstp.exe'\n            - '\\conhost.exe'\n            - '\\consent.exe'\n            - '\\cscript.exe'\n            - '\\csrss.exe'\n            - '\\dashost.exe'\n            - '\\defrag.exe'\n            - '\\dfrgui.exe' # Was seen used by Lazarus Group - https://asec.ahnlab.com/en/39828/\n            - '\\dism.exe'\n            - '\\dllhost.exe'\n            - '\\dllhst3g.exe'\n            - '\\dwm.exe'\n            - '\\eventvwr.exe'\n            - '\\fsquirt.exe' # was seen used by sidewinder APT - https://securelist.com/sidewinder-apt/114089/\n            - '\\finger.exe'\n            - '\\logonui.exe'\n            - '\\LsaIso.exe'\n            - '\\lsass.exe'\n            - '\\lsm.exe'\n            - '\\msiexec.exe'\n            - '\\ntoskrnl.exe'\n            - '\\powershell_ise.exe'\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n            - '\\regsvr32.exe'\n            - '\\rundll32.exe'\n            - '\\runonce.exe'\n            - '\\RuntimeBroker.exe'\n            - '\\schtasks.exe'\n            - '\\services.exe'\n            - '\\sihost.exe'\n            - '\\smartscreen.exe'\n            - '\\smss.exe'\n            - '\\spoolsv.exe'\n            - '\\svchost.exe'\n            - '\\taskhost.exe'\n            - '\\taskhostw.exe'\n            - '\\Taskmgr.exe'\n            - '\\userinit.exe'\n            - '\\werfault.exe'\n            - '\\werfaultsecure.exe'\n            - '\\wininit.exe'\n            - '\\winlogon.exe'\n            - '\\winver.exe'\n            - '\\wlanext.exe'\n            - '\\wscript.exe'\n            - '\\wsl.exe'\n            - '\\wsmprovhost.exe' # Was seen used by Lazarus Group - https://asec.ahnlab.com/en/39828/\n    filter_main_generic:\n        Image|startswith:\n            - 'C:\\$WINDOWS.~BT\\'\n            - 'C:\\$WinREAgent\\'\n            - 'C:\\Windows\\SoftwareDistribution\\'\n            - 'C:\\Windows\\System32\\'\n            - 'C:\\Windows\\SystemTemp\\'\n            - 'C:\\Windows\\SysWOW64\\'\n            - 'C:\\Windows\\uus\\'\n            - 'C:\\Windows\\WinSxS\\'\n    filter_optional_system32:\n        Image|contains: '\\SystemRoot\\System32\\'\n    filter_main_powershell:\n        Image|contains:\n            - 'C:\\Program Files\\PowerShell\\7\\'\n            - 'C:\\Program Files\\PowerShell\\7-preview\\'\n            - 'C:\\Program Files\\WindowsApps\\Microsoft.PowerShellPreview'\n            - '\\AppData\\Local\\Microsoft\\WindowsApps\\Microsoft.PowerShellPreview' # pwsh installed from Microsoft Store\n        Image|endswith: '\\pwsh.exe'\n    filter_main_wsl_programfiles:\n        Image|startswith:\n            - 'C:\\Program Files\\WindowsApps\\MicrosoftCorporationII.WindowsSubsystemForLinux'\n            - 'C:\\Program Files\\WSL\\'\n        Image|endswith: '\\wsl.exe'\n    filter_main_wsl_appdata:\n        Image|startswith: C:\\Users\\'\n        Image|contains: '\\AppData\\Local\\Microsoft\\WindowsApps\\'\n        Image|endswith: '\\wsl.exe'\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Unknown\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_susp_system_exe_anomaly/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036","id":"T1036","name":"Masquerading","page":"techniques/enterprise/T1036/"}],"data_path":"data/detection-rules/e4a6b256-3e47-40fc-89d2-7a477edd6915.json","kind":"sigma"}