detection.wiki

Detection rules › Splunk

Executables Or Script Creation In Suspicious Path

Author
Teoderick Contreras, Splunk
Source
upstream

The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem dataset to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts, \users\public). This activity can be significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1036 Masquerading

Event coverage

ProviderEvent IDTitle
Sysmon11FileCreate

Stages and Predicates

Stage 1: tstats

tstats WHERE Filesystem.file_name IN ("*.bat", "*.cmd", "*.com", "*.dll", "*.exe", "*.js", "*.msc", "*.pif", "*.ps1", "*.sys", "*.vbe", "*.vbs") Filesystem.file_path IN ("*:\\inetpub\\*", "*Recycle.bin*", "*\\PerfLogs\\*", "*\\Users\\Administrator\\Music\\*", "*\\Users\\Default\\*", "*\\Users\\Public\\*", "*\\Windows\\Media\\*", "*\\Windows\\debug\\*", "*\\Windows\\fonts\\*", "*\\Windows\\repair\\*", "*\\Windows\\servicing\\*") BY Filesystem.action, Filesystem.dest, Filesystem.file_access_time, Filesystem.file_create_time, Filesystem.file_hash, Filesystem.file_modify_time, Filesystem.file_name, Filesystem.file_path, Filesystem.file_acl, Filesystem.file_size, Filesystem.process_guid, Filesystem.process_id, Filesystem.user, Filesystem.vendor_product

Stage 2: search

search

Stage 3: search

search

Stage 4: search

search

Stage 5: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Filesystem.file_namein
  • "*.bat" corpus 4 (splunk 4)
  • "*.cmd" corpus 4 (splunk 4)
  • "*.com" corpus 4 (splunk 4)
  • "*.dll" corpus 6 (splunk 6)
  • "*.exe" corpus 7 (splunk 7)
  • "*.js" corpus 5 (splunk 5)
  • "*.msc" corpus 2 (splunk 2)
  • "*.pif" corpus 5 (splunk 5)
  • "*.ps1" corpus 3 (splunk 3)
  • "*.sys" corpus 4 (splunk 4)
  • "*.vbe" corpus 5 (splunk 5)
  • "*.vbs" corpus 5 (splunk 5)
Filesystem.file_pathin
  • "*:\\inetpub\\*"
  • "*Recycle.bin*" corpus 2 (splunk 2)
  • "*\\PerfLogs\\*" corpus 2 (splunk 2)
  • "*\\Users\\Administrator\\Music\\*" corpus 2 (splunk 2)
  • "*\\Users\\Default\\*" corpus 2 (splunk 2)
  • "*\\Users\\Public\\*"
  • "*\\Windows\\Media\\*" corpus 2 (splunk 2)
  • "*\\Windows\\debug\\*"
  • "*\\Windows\\fonts\\*"
  • "*\\Windows\\repair\\*" corpus 2 (splunk 2)
  • "*\\Windows\\servicing\\*" corpus 3 (splunk 3)