1200KM / sigma-rule
Suspicious Files in Default GPO Folder — Sigma Rule
Sigma rule 5f87308a-0a5b-4623-ae15-d8fa1809bc60. Suspicious Files in Default GPO Folder — Sigma Rule. Detects the creation of copy of suspicious files (EXE/DLL) to the default GPO storage folder
Rule metadata and linked tags
Author: elhoim. Source status: test; severity: medium. Source dates: 2022-04-28 / not supplied.
{
"product": "windows",
"category": "file_event"
}Pinned original Sigma rule · Detection Rule License 1.1
Source SHA-256: e11fdb57fdf217688224836e2e2efc48734152ee919803d8af97f7c86ae288f2
Detection logic
Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.
title: Suspicious Files in Default GPO Folder
id: 5f87308a-0a5b-4623-ae15-d8fa1809bc60
status: test
description: Detects the creation of copy of suspicious files (EXE/DLL) to the default GPO storage folder
references:
- https://redcanary.com/blog/intelligence-insights-november-2021/
author: elhoim
date: 2022-04-28
tags:
- attack.stealth
- attack.t1036.005
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|contains: '\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\'
TargetFilename|endswith:
- '.dll'
- '.exe'
condition: selection
falsepositives:
- Unknown
level: medium
False positives
- Unknown
Source references
Connected ecosystem references
Exact source-tagged techniques
Telemetry review
Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.