Suspicious Copy From or To System Directory

Severity: medium
Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems)
Source: upstream

Detects a suspicious copy operation that tries to copy a program from system (System32, SysWOW64, WinSxS) directories to another on disk. Often used to move LOLBINs such as 'certutil' or 'desktopimgdownldr' to a different location with a different name in order to bypass detections based on locations.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1036.003` Masquerading: Rename Legitimate Utilities

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `1 of selection_img_cmd`

CommandLine|contains: 'copy '
Image|endswith: '\cmd.exe'

Stage 2: `1 of selection_img_pwsh`

or:
CommandLine|contains: ' copy '
CommandLine|contains: ' cp '
CommandLine|contains: copy-item
CommandLine|contains: 'cpi '
or:
Image|endswith: '\powershell.exe'
Image|endswith: '\pwsh.exe'

Stage 3: `1 of selection_img_other`

or:
Image|endswith: '\robocopy.exe'
Image|endswith: '\xcopy.exe'
OriginalFileName: XCOPY.EXE
OriginalFileName: robocopy.exe

Stage 4: `selection_target`

CommandLine|re: '(?i)\s[''"]?C:\\Windows\\(System32|SysWOW64|WinSxS)'

Stage 5: `not 1 of filter_optional_avira`

or:
CommandLine|contains: 'C:\Program Files (x86)\Avira\'
CommandLine|contains: 'C:\Program Files\Avira\'
CommandLine|contains: '/c copy'
CommandLine|contains: '\Temp\'
CommandLine|contains: '\avira_system_speedup.exe'
Image|endswith: '\cmd.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`copy` corpus 4 (sigma 4) `cp` corpus 5 (sigma 5) `/c copy` `C:\Program Files (x86)\Avira\` `C:\Program Files\Avira\` `\Temp\` corpus 7 (sigma 7) `\avira_system_speedup.exe` `copy` corpus 11 (sigma 11) `copy-item` corpus 4 (sigma 4) `cpi` corpus 4 (sigma 4)
`CommandLine`	regex_match	`(?i)\s['"]?C:\\Windows\\(System32\|SysWOW64\|WinSxS)`
`Image`	ends_with	`\cmd.exe` corpus 92 (sigma 92) `\powershell.exe` corpus 143 (sigma 143) `\pwsh.exe` corpus 140 (sigma 140) `\robocopy.exe` corpus 5 (sigma 5) `\xcopy.exe` corpus 5 (sigma 5)
`OriginalFileName`	eq	`XCOPY.EXE` corpus 4 (sigma 4) `robocopy.exe` corpus 4 (sigma 4)

Suspicious Copy From or To System Directory

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: 1 of selection_img_cmd

Stage 2: 1 of selection_img_pwsh

Stage 3: 1 of selection_img_other