Detectionhightest

Suspicious Executable File Creation

Detect creation of suspicious executable file names. Some strings look for suspicious file extensions, others look for filenames that exploit unquoted service paths.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

François HubautCreated Mon Sep 05Updated Mon Dec 1174babdd6-a758-4549-9632-26535279e654windows

Log Source

WindowsFile Event

ProductWindows← raw: windows

CategoryFile Event← raw: file_event

Events for file system activity including creation, modification, and deletion.

Detection Logic

detection:
    selection:
        TargetFilename|endswith:
            - ':\$Recycle.Bin.exe'
            - ':\Documents and Settings.exe'
            - ':\MSOCache.exe'
            - ':\PerfLogs.exe'
            - ':\Recovery.exe'
            - '.bat.exe'
            - '.sys.exe'
    condition: selection