Process Execution From A Potentially Suspicious Folder

Title: Process Execution From A Potentially Suspicious Folder
Status: test
Description:Detects a potentially suspicious execution from an uncommon folder.
References:
  -https://github.com/mbevilacqua/appcompatprocessor/blob/6c847937c5a836e2ce2fe2b915f213c345a3c389/AppCompatSearch.txt
  -https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses
  -https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
  -https://github.com/ThreatHuntingProject/ThreatHunting/blob/cb22598bb70651f88e0285abc8d835757d2cb596/hunts/suspicious_process_creation_via_windows_event_logs.md
Author: Florian Roth (Nextron Systems), Tim Shelton
Date: 2019-01-16
modified:2024-07-12
Tags:

• -'attack.stealth'
• -'attack.t1036'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|contains:
      -':\Perflogs\'
      -':\Users\All Users\'
      -':\Users\Default\'
      -':\Users\NetworkService\'
      -':\Windows\addins\'
      -':\Windows\debug\'
      -':\Windows\Fonts\'
      -':\Windows\Help\'
      -':\Windows\IME\'
      -':\Windows\Media\'
      -':\Windows\repair\'
      -':\Windows\security\'
      -':\Windows\System32\Tasks\'
      -':\Windows\Tasks\'
      -'$Recycle.bin'
      -'\config\systemprofile\'
      -'\Intel\Logs\'
      -'\RSA\MachineKeys\'

  filter_optional_ibm:
    Image|startswith: 'C:\Users\Public\IBM\ClientSolutions\Start_Programs\'
  filter_optional_citrix:
    Image|startswith: 'C:\Windows\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\'
    Image|endswith: '\CitrixReceiverUpdater.exe'
  condition:selection and not 1 of filter_optional_*
Falsepositives:
  -Unknown
Level: high