{"id":"f0540f7e-2db3-4432-b9e0-3965486744bc","title":"Legitimate Application Dropped Executable","description":"Detects programs on a Windows system that should not write executables to disk","author":"frack113, Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-08-21","modified":"2023-06-22","tags":["attack.stealth","attack.t1218"],"technique_ids":["T1218"],"logsource":{"product":"windows","category":"file_event"},"falsepositives":["Unknown"],"references":["https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326"],"source_path":"rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_exe.yml","source_sha256":"cbea1413164ab400f987074d2bbea48c178ab683a02776671cd504c8ab668a93","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_exe.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Legitimate Application Dropped Executable\nid: f0540f7e-2db3-4432-b9e0-3965486744bc\nstatus: test\ndescription: Detects programs on a Windows system that should not write executables to disk\nreferences:\n    - https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326\nauthor: frack113, Florian Roth (Nextron Systems)\ndate: 2022-08-21\nmodified: 2023-06-22\ntags:\n    - attack.stealth\n    - attack.t1218\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    selection:\n        Image|endswith:\n            # Microsoft Office Programs Dropping Executables / Rest of the apps are covered in: c7a74c80-ba5a-486e-9974-ab9e682bc5e4\n            - '\\eqnedt32.exe'\n            - '\\wordpad.exe'\n            - '\\wordview.exe'\n            # LOLBINs that can be used to download executables\n            - '\\certutil.exe'\n            - '\\certoc.exe'\n            - '\\CertReq.exe'\n            # - \\bitsadmin.exe (depends on the environment; comment in if you're sure that bitsadmin doesn't do that in your env)\n            - '\\Desktopimgdownldr.exe'\n            - '\\esentutl.exe'\n            # - \\expand.exe\n            - '\\mshta.exe'\n            # Executables that should never drop an executable to disk (but may after a previous process injection or if it's malware that uses a legitimate name)\n            - '\\AcroRd32.exe'\n            - '\\RdrCEF.exe'\n            - '\\hh.exe'\n            - '\\finger.exe'\n        TargetFilename|endswith:\n            - '.exe'\n            - '.dll'\n            - '.ocx'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","page":"techniques/enterprise/T1218/"}],"data_path":"data/detection-rules/f0540f7e-2db3-4432-b9e0-3965486744bc.json","kind":"sigma"}