Detection rules › Sigma

Suspicious Executable File Creation

Severity
high
Author
frack113
Source
upstream

Detect creation of suspicious executable file names. Some strings look for suspicious file extensions, others look for filenames that exploit unquoted service paths.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1564 Hide Artifacts

Event coverage

ProviderEvent IDTitle
Sysmon11FileCreate

Stages and Predicates

Stage 1: selection

or:
TargetFilename|endswith: .bat.exe
TargetFilename|endswith: .sys.exe
TargetFilename|endswith: ':\$Recycle.Bin.exe'
TargetFilename|endswith: ':\Documents and Settings.exe'
TargetFilename|endswith: ':\MSOCache.exe'
TargetFilename|endswith: ':\PerfLogs.exe'
TargetFilename|endswith: ':\Recovery.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
TargetFilenameends_with
  • .bat.exe
  • .sys.exe
  • :\$Recycle.Bin.exe
  • :\Documents and Settings.exe
  • :\MSOCache.exe
  • :\PerfLogs.exe
  • :\Recovery.exe