Windows Binaries Write Suspicious Extensions

Title: Windows Binaries Write Suspicious Extensions
Status: test
Description:Detects Windows executables that write files with suspicious extensions
References:
  -Internal Research
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-12
modified:2025-10-07
Tags:

• -'attack.stealth'
• -'attack.t1036'

Logsource:

• category: file_event
• product: windows

Detection:
  selection_generic:
    Image|endswith:
      -'\csrss.exe'
      -'\lsass.exe'
      -'\RuntimeBroker.exe'
      -'\sihost.exe'
      -'\smss.exe'
      -'\wininit.exe'
      -'\winlogon.exe'

    TargetFilename|endswith:
      -'.bat'
      -'.dll'
      -'.exe'
      -'.hta'
      -'.iso'
      -'.ps1'
      -'.txt'
      -'.vbe'
      -'.vbs'

  selection_special:
    Image|endswith:
      -'\dllhost.exe'
      -'\rundll32.exe'
      -'\svchost.exe'

    TargetFilename|endswith:
      -'.bat'
      -'.hta'
      -'.iso'
      -'.ps1'
      -'.vbe'
      -'.vbs'

  filter_main_AppLockerPolicyTest:
    Image: 'C:\Windows\System32\dllhost.exe'
    TargetFilename|contains|all:
      -':\Users\'
      -'\AppData\Local\Temp\__PSScriptPolicyTest_'

    TargetFilename|endswith: '.ps1'
  filter_main_script_gpo_machine:
    Image: 'C:\Windows\system32\svchost.exe'
    TargetFilename|contains|all:
      -'C:\Windows\System32\GroupPolicy\DataStore\'
      -'\sysvol\'
      -'\Policies\'
      -'\Machine\Scripts\Startup\'

    TargetFilename|endswith:
      -'.ps1'
      -'.bat'

  filter_main_clipchamp:
    Image: 'C:\Windows\system32\svchost.exe'
    TargetFilename|contains|all:
      -'C:\Program Files\WindowsApps\Clipchamp'
      -'.ps1'

  filter_main_powershell_preview:
    Image:
      -'C:\Windows\system32\svchost.exe'
      -'C:\Windows\SysWOW64\svchost.exe'

    TargetFilename|startswith:
      -'C:\Program Files\WindowsApps\Microsoft.PowerShellPreview'
      -'C:\Program Files (x86)\WindowsApps\Microsoft.PowerShellPreview'

    TargetFilename|endswith: '.ps1'
  condition:1 of selection_* and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: high