Detection rules › Sigma

Suspicious Calculator Usage

Severity
high
Author
Florian Roth (Nextron Systems)
Source
upstream

Detects suspicious use of 'calc.exe' with command line parameters or in a suspicious directory, which is likely caused by some PoC or detection evasion.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1036 Masquerading

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Security-Auditing4688A new process has been created.

Stages and Predicates

Stage 1: selection_1

CommandLine|contains: '\calc.exe '

Stage 2: selection_2

Image|endswith: '\calc.exe'

Stage 3: not filter_main_known_locations

or:
Image|contains: ':\Windows\SysWOW64\'
Image|contains: ':\Windows\System32\'
Image|contains: ':\Windows\WinSxS\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • \calc.exe
Imageends_with
  • \calc.exe corpus 13 (sigma 13)
Imagematch
  • :\Windows\SysWOW64\ corpus 7 (sigma 7)
  • :\Windows\System32\ corpus 6 (sigma 6)
  • :\Windows\WinSxS\ corpus 3 (sigma 3)