LOL-Binary Copied From System Directory

Severity: high
Author: Nasreddine Bencherchali (Nextron Systems)
Source: upstream

Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1036.003` Masquerading: Rename Legitimate Utilities

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `1 of selection_tools_cmd`

CommandLine|contains: 'copy '
Image|endswith: '\cmd.exe'

Stage 2: `1 of selection_tools_pwsh`

or:
CommandLine|contains: ' copy '
CommandLine|contains: ' cp '
CommandLine|contains: copy-item
CommandLine|contains: 'cpi '
or:
Image|endswith: '\powershell.exe'
Image|endswith: '\pwsh.exe'

Stage 3: `1 of selection_tools_other`

or:
Image|endswith: '\robocopy.exe'
Image|endswith: '\xcopy.exe'
OriginalFileName: XCOPY.EXE
OriginalFileName: robocopy.exe

Stage 4: `all of selection_target_path`

or:
CommandLine|contains: '\SysWOW64'
CommandLine|contains: '\System32'
CommandLine|contains: '\WinSxS'

Stage 5: `all of selection_target_lolbin`

or:
CommandLine|contains: '\bitsadmin.exe'
CommandLine|contains: '\calc.exe'
CommandLine|contains: '\certutil.exe'
CommandLine|contains: '\cmdl32.exe'
CommandLine|contains: '\cscript.exe'
CommandLine|contains: '\ie4uinit.exe'
CommandLine|contains: '\mshta.exe'
CommandLine|contains: '\rundll32.exe'
CommandLine|contains: '\wscript.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`copy` corpus 4 (sigma 4) `cp` corpus 5 (sigma 5) `\SysWOW64` `\System32` `\WinSxS` `\bitsadmin.exe` `\calc.exe` `\certutil.exe` `\cmdl32.exe` `\cscript.exe` `\ie4uinit.exe` `\mshta.exe` `\rundll32.exe` `\wscript.exe` `copy` corpus 11 (sigma 11) `copy-item` corpus 4 (sigma 4) `cpi` corpus 4 (sigma 4)
`Image`	ends_with	`\cmd.exe` corpus 92 (sigma 92) `\powershell.exe` corpus 143 (sigma 143) `\pwsh.exe` corpus 140 (sigma 140) `\robocopy.exe` corpus 5 (sigma 5) `\xcopy.exe` corpus 5 (sigma 5)
`OriginalFileName`	eq	`XCOPY.EXE` corpus 4 (sigma 4) `robocopy.exe` corpus 4 (sigma 4)

LOL-Binary Copied From System Directory

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: 1 of selection_tools_cmd

Stage 2: 1 of selection_tools_pwsh

Stage 3: 1 of selection_tools_other