
title: Suspicious Program Location with Network Connections
author: Florian Roth
date: 2017/03/19
description: Detects programs with network connections running in suspicious files
  system locations
detection:
  SELECTION_1:
    EventID: 3
  SELECTION_2:
    Image:
    - '*\Users\All Users\\*'
    - '*\Users\Default\\*'
    - '*\Users\Public\\*'
    - '*\Users\Contacts\\*'
    - '*\Users\Searches\\*'
    - '*\config\systemprofile\\*'
    - '*\Windows\Fonts\\*'
    - '*\Windows\IME\\*'
    - '*\Windows\addins\\*'
  SELECTION_3:
    Image:
    - '*\$Recycle.bin'
  SELECTION_4:
    Image:
    - C:\Perflogs\\*
  condition: (SELECTION_1 and (SELECTION_2 or SELECTION_3 or SELECTION_4))
falsepositives:
- unknown
id: 7b434893-c57d-4f41-908d-6a17bf1ae98f
level: high
logsource:
  category: network_connection
  definition: Use the following config to generate the necessary Event ID 3 Network
    Connection events
  product: windows
references:
- https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo
status: experimental
tags:
- attack.command_and_control
- attack.t1105
ruletype: SIGMA
