Detectionhightest
Suspicious File Creation Activity From Fake Recycle.Bin Folder
Detects file write event from/to a fake recycle bin folder that is often used as a staging directory for malware
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
X__Junior (Nextron Systems)Created Wed Jul 12Updated Mon Dec 11cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bcawindows
Log Source
WindowsFile Event
ProductWindows← raw: windows
CategoryFile Event← raw: file_event
Events for file system activity including creation, modification, and deletion.
Detection Logic
Detection Logic1 selector
detection:
selection:
- Image|contains:
# e.g. C:\$RECYCLER.BIN
- 'RECYCLERS.BIN\'
- 'RECYCLER.BIN\'
- TargetFilename|contains:
# e.g. C:\$RECYCLER.BIN
- 'RECYCLERS.BIN\'
- 'RECYCLER.BIN\'
condition: selectionFalse Positives
Unknown
False positive likelihood has not been assessed. Additional context may be needed during triage.
MITRE ATT&CK
Rule Metadata
Rule ID
cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca
Status
test
Level
high
Type
Detection
Created
Wed Jul 12
Modified
Mon Dec 11
Path
rules/windows/file/file_event/file_event_win_susp_recycle_bin_fake_exec.yml
Raw Tags
attack.persistenceattack.defense-evasion