Detectionhighexperimental

Suspicious Binaries and Scripts in Public Folder

Detects the creation of a file with a suspicious extension in the public folder, which could indicate potential malicious activity.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

The DFIR ReportCreated Thu Jan 23b447f7de-1e53-4cbf-bfb4-f1f6d0b04e4ewindows

Log Source

WindowsFile Event

ProductWindows← raw: windows

CategoryFile Event← raw: file_event

Events for file system activity including creation, modification, and deletion.

Detection Logic

detection:
    selection:
        TargetFilename|contains: ':\Users\Public\'
        TargetFilename|endswith:
            - '.bat'
            - '.dll'
            - '.exe'
            - '.hta'
            - '.js'
            - '.ps1'
            - '.vbe'
            - '.vbs'
    condition: selection