Name:Executables Or Script Creation In Suspicious Path id:a7e3f0f0-ae42-11eb-b245-acde48001122 version:14 date:2025-04-16 author:Teoderick Contreras, Splunk status:production type:Anomaly Description:The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem data model to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity is significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat. Data_source:
-Sysmon EventID 11
search:| tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif") AND Filesystem.file_path IN ("*\\windows\\fonts\\*", "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "*\\Windows\\repair\\*", "*\\AppData\\Local\\Temp*", "*\\PerfLogs\\*", "*:\\temp\\*") by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `executables_or_script_creation_in_suspicious_path_filter`
how_to_implement:To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. known_false_positives:Administrators may allow creation of script or exe in the paths specified. Filter as needed. References: -https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -https://twitter.com/pr0xylife/status/1590394227758104576 -https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ drilldown_searches: name:'View the detection results for - "$user$"' search:'%original_detection_search% | search user = "$user$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$user$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' tags: analytic_story: - 'SystemBC' - 'Snake Keylogger' - 'China-Nexus Threat Activity' - 'Remcos' - 'LockBit Ransomware' - 'AsyncRAT' - 'DarkCrystal RAT' - 'Derusbi' - 'WinDealer RAT' - 'DarkGate Malware' - 'Crypto Stealer' - 'ValleyRAT' - 'AcidPour' - 'PlugX' - 'Data Destruction' - 'Qakbot' - 'CISA AA23-347A' - 'Hermetic Wiper' - 'Volt Typhoon' - 'Double Zero Destructor' - 'NjRAT' - 'Trickbot' - 'AgentTesla' - 'Meduza Stealer' - 'SnappyBee' - 'Azorult' - 'WhisperGate' - 'Warzone RAT' - 'Swift Slicer' - 'Rhysida Ransomware' - 'Brute Ratel C4' - 'BlackByte Ransomware' - 'Graceful Wipe Out Attack' - 'Chaos Ransomware' - 'Handala Wiper' - 'RedLine Stealer' - 'Salt Typhoon' - 'XMRig' - 'MoonPeak' - 'Industroyer2' - 'Amadey' - 'IcedID' - 'Earth Alux' asset_type:Endpoint mitre_attack_id: - 'T1036' product: - 'Splunk Enterprise' - 'Splunk Enterprise Security' - 'Splunk Cloud' security_domain:endpoint
