title: Execution from Suspicious Folder
author: Florian Roth
date: 2019/01/16
description: Detects a suspicious execution from an uncommon folder
detection:
    SELECTION_1:
        EventID: 1
    SELECTION_10:
        Image: '*\Windows\addins\\*'
    SELECTION_11:
        Image: '*\Windows\debug\\*'
    SELECTION_12:
        Image: '*\Windows\Fonts\\*'
    SELECTION_13:
        Image: '*\Windows\Help\\*'
    SELECTION_14:
        Image: '*\Windows\IME\\*'
    SELECTION_15:
        Image: '*\Windows\Media\\*'
    SELECTION_16:
        Image: '*\Windows\repair\\*'
    SELECTION_17:
        Image: '*\Windows\security\\*'
    SELECTION_18:
        Image: '*\Windows\system32\config\systemprofile\\*'
    SELECTION_19:
        Image: '*\Windows\System32\Tasks\\*'
    SELECTION_2:
        Image: '*\$Recycle.bin\\*'
    SELECTION_20:
        Image: '*\Windows\Tasks\\*'
    SELECTION_21:
        Image: C:\Perflogs\\*
    SELECTION_3:
        Image: '*\config\systemprofile\\*'
    SELECTION_4:
        Image: '*\Intel\Logs\\*'
    SELECTION_5:
        Image: '*\RSA\MachineKeys\\*'
    SELECTION_6:
        Image: '*\Users\All Users\\*'
    SELECTION_7:
        Image: '*\Users\Default\\*'
    SELECTION_8:
        Image: '*\Users\NetworkService\\*'
    SELECTION_9:
        Image: '*\Users\Public\\*'
    condition: (SELECTION_1 and ((SELECTION_2 or SELECTION_3 or SELECTION_4 or SELECTION_5
        or SELECTION_6 or SELECTION_7 or SELECTION_8 or SELECTION_9 or SELECTION_10
        or SELECTION_11 or SELECTION_12 or SELECTION_13 or SELECTION_14 or SELECTION_15
        or SELECTION_16 or SELECTION_17 or SELECTION_18 or SELECTION_19 or SELECTION_20)
        or SELECTION_21))
falsepositives:
- Unknown
fields:
- CommandLine
- ParentCommandLine
id: 3dfd06d2-eaf4-4532-9555-68aca59f57c4
level: high
logsource:
    category: process_creation
    product: windows
modified: 2021/03/31
references:
- https://github.com/mbevilacqua/appcompatprocessor/blob/master/AppCompatSearch.txt
- https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses
- https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
- https://github.com/ThreatHuntingProject/ThreatHunting/blob/master/hunts/suspicious_process_creation_via_windows_event_logs.md
status: experimental
tags:
- attack.defense_evasion
- attack.t1036
yml_filename: win_susp_execution_path.yml
yml_path: /Users/user/Documents/YamatoSecurity/sigma/rules/windows/process_creation