Process Execution From A Potentially Suspicious Folder

Hunt Hypothesis

Detects a potentially suspicious execution from an uncommon folder.

Detection Rule

Sigma (Original)

title: Process Execution From A Potentially Suspicious Folder
id: 3dfd06d2-eaf4-4532-9555-68aca59f57c4
status: test
description: Detects a potentially suspicious execution from an uncommon folder.
references:
    - https://github.com/mbevilacqua/appcompatprocessor/blob/6c847937c5a836e2ce2fe2b915f213c345a3c389/AppCompatSearch.txt
    - https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses
    - https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
    - https://github.com/ThreatHuntingProject/ThreatHunting/blob/cb22598bb70651f88e0285abc8d835757d2cb596/hunts/suspicious_process_creation_via_windows_event_logs.md
author: Florian Roth (Nextron Systems), Tim Shelton
date: 2019-01-16
modified: 2024-07-12
tags:
    - attack.stealth
    - attack.t1036
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|contains:
            - ':\Perflogs\'
            - ':\Users\All Users\'
            - ':\Users\Default\'
            - ':\Users\NetworkService\'
            - ':\Windows\addins\'
            - ':\Windows\debug\'
            - ':\Windows\Fonts\'
            - ':\Windows\Help\'
            - ':\Windows\IME\'
            - ':\Windows\Media\'
            - ':\Windows\repair\'
            - ':\Windows\security\'
            - ':\Windows\System32\Tasks\'
            - ':\Windows\Tasks\'
            - '$Recycle.bin'
            - '\config\systemprofile\'
            - '\Intel\Logs\'
            - '\RSA\MachineKeys\'
    filter_optional_ibm:
        Image|startswith: 'C:\Users\Public\IBM\ClientSolutions\Start_Programs\'
    filter_optional_citrix:
        Image|startswith: 'C:\Windows\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\'
        Image|endswith: '\CitrixReceiverUpdater.exe'
    condition: selection and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: high

KQL (Azure Sentinel)

imProcessCreate
| where (TargetProcessName contains ":\\Perflogs\\" or TargetProcessName contains ":\\Users\\All Users\\" or TargetProcessName contains ":\\Users\\Default\\" or TargetProcessName contains ":\\Users\\NetworkService\\" or TargetProcessName contains ":\\Windows\\addins\\" or TargetProcessName contains ":\\Windows\\debug\\" or TargetProcessName contains ":\\Windows\\Fonts\\" or TargetProcessName contains ":\\Windows\\Help\\" or TargetProcessName contains ":\\Windows\\IME\\" or TargetProcessName contains ":\\Windows\\Media\\" or TargetProcessName contains ":\\Windows\\repair\\" or TargetProcessName contains ":\\Windows\\security\\" or TargetProcessName contains ":\\Windows\\System32\\Tasks\\" or TargetProcessName contains ":\\Windows\\Tasks\\" or TargetProcessName contains "$Recycle.bin" or TargetProcessName contains "\\config\\systemprofile\\" or TargetProcessName contains "\\Intel\\Logs\\" or TargetProcessName contains "\\RSA\\MachineKeys\\") and (not((TargetProcessName startswith "C:\\Users\\Public\\IBM\\ClientSolutions\\Start_Programs\\" or (TargetProcessName startswith "C:\\Windows\\SysWOW64\\config\\systemprofile\\Citrix\\UpdaterBinaries\\" and TargetProcessName endswith "\\CitrixReceiverUpdater.exe"))))

Required Data Sources

False Positive Guidance

• Unknown

MITRE ATT&CK Context

• Technique: T1036 — T1036

References

• https://github.com/mbevilacqua/appcompatprocessor/blob/6c847937c5a836e2ce2fe2b915f213c345a3c389/AppCompatSearch.txt
• https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses
• https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
• https://github.com/ThreatHuntingProject/ThreatHunting/blob/cb22598bb70651f88e0285abc8d835757d2cb596/hunts/suspicious_process_creation_via_windows_event_logs.md
• SigmaHQ Rule