LoFP LoFP / some false positives may arise from paths like recycle.bin and \users\public. other than that executable creation and certain script extensions in these suspicious paths should be less common.

Techniques

Sample rules

Executables Or Script Creation In Suspicious Path

Description

The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem dataset to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts, \users\public). This activity can be significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.

Detection logic


| tstats `security_content_summariesonly`
  count min(_time) as firstTime
        max(_time) as lastTime

from datamodel=Endpoint.Filesystem where

Filesystem.file_name IN (
  "*.bat",
  "*.cmd",
  "*.com",
  "*.dll",
  "*.exe",
  "*.js",
  "*.msc",
  "*.pif",
  "*.ps1",
  "*.sys",
  "*.vbe",
  "*.vbs"
)
Filesystem.file_path IN (
  "*\\PerfLogs\\*",
  "*\\Users\\Administrator\\Music\\*",
  "*\\Users\\Default\\*",
  "*\\Users\\Public\\*",
  "*\\Windows\\debug\\*",
  "*\\Windows\\fonts\\*",
  "*\\Windows\\Media\\*",
  "*\\Windows\\repair\\*",
  "*\\Windows\\servicing\\*",
  "*Recycle.bin*",
)

by Filesystem.action Filesystem.dest Filesystem.file_access_time
   Filesystem.file_create_time Filesystem.file_hash
   Filesystem.file_modify_time Filesystem.file_name
   Filesystem.file_path Filesystem.file_acl Filesystem.file_size
   Filesystem.process_guid Filesystem.process_id Filesystem.user
   Filesystem.vendor_product

| `drop_dm_object_name(Filesystem)`

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `executables_or_script_creation_in_suspicious_path_filter`