Suspicious Process Start Locations

Title: Suspicious Process Start Locations
Status: test
Description:Detects suspicious process run from unusual locations
References:
  -https://car.mitre.org/wiki/CAR-2013-05-002
Author: juju4, Jonhnathan Ribeiro, oscd.community
Date: 2019-01-16
modified:2022-01-07
Tags:

• -'attack.stealth'
• -'attack.t1036'
• -'car.2013-05-002'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    - Image|contains:
      - ':\RECYCLER\'
      - ':\SystemVolumeInformation\'
    - Image|startswith:
      - 'C:\Windows\Tasks\'
      - 'C:\Windows\debug\'
      - 'C:\Windows\fonts\'
      - 'C:\Windows\help\'
      - 'C:\Windows\drivers\'
      - 'C:\Windows\addins\'
      - 'C:\Windows\cursors\'
      - 'C:\Windows\system32\tasks\'
  condition:selection
Falsepositives:
  -False positives depend on scripts and administrative tools used in the monitored environment
Level: medium