Executables Or Script Creation In Suspicious Path

Name:Executables Or Script Creation In Suspicious Path
id:a7e3f0f0-ae42-11eb-b245-acde48001122
version:23
date:2026-02-12
author:Teoderick Contreras, Splunk
status:production
type:Anomaly
Description:The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem dataset to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity can be significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
Data_source:

• -Sysmon EventID 11

search:| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime

from datamodel=Endpoint.Filesystem where

Filesystem.file_name IN (
"*.bat",
"*.cmd",
"*.com",
"*.dll",
"*.exe",
"*.js",
"*.msc",
"*.pif",
"*.ps1",
"*.sys",
"*.vbe",
"*.vbs"
)
Filesystem.file_path IN (
"*\\PerfLogs\\*",
"*\\Users\\Administrator\\Music\\*",
"*\\Users\\Default\\*",
"*\\Users\\Public\\*",
"*\\Windows\\debug\\*",
"*\\Windows\\fonts\\*",
"*\\Windows\\Media\\*",
"*\\Windows\\repair\\*",
"*\\Windows\\servicing\\*",
"*Recycle.bin*",
"*:\\inetpub\\*"
)

by Filesystem.action Filesystem.dest Filesystem.file_access_time
Filesystem.file_create_time Filesystem.file_hash
Filesystem.file_modify_time Filesystem.file_name
Filesystem.file_path Filesystem.file_acl Filesystem.file_size
Filesystem.process_guid Filesystem.process_id Filesystem.user
Filesystem.vendor_product
| `drop_dm_object_name(Filesystem)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `executables_or_script_creation_in_suspicious_path_filter`


how_to_implement:To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
known_false_positives:Some false positives may arise from paths like Recycle.bin and \Users\Public. Other than that executable creation and certain script extensions in these suspicious paths should be less common.
References:
  -https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
  -https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
  -https://twitter.com/pr0xylife/status/1590394227758104576
  -https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
drilldown_searches:
 name:'View the detection results for - "$user$"'
 search:'%original_detection_search% | search user = "$user$"'
 earliest_offset:'$info_min_time$'
 latest_offset:'$info_max_time$'
 name:'View risk events for the last 7 days for - "$user$"'
 search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
 earliest_offset:'$info_min_time$'
 latest_offset:'$info_max_time$'
tags:
  analytic_story:
    - 'PlugX'
    - 'Warzone RAT'
    - 'Swift Slicer'
    - 'Data Destruction'
    - 'AgentTesla'
    - 'LockBit Ransomware'
    - 'Volt Typhoon'
    - 'Brute Ratel C4'
    - 'Industroyer2'
    - 'WhisperGate'
    - 'DarkGate Malware'
    - 'Chaos Ransomware'
    - 'ValleyRAT'
    - 'XMRig'
    - 'Hermetic Wiper'
    - 'Remcos'
    - 'Quasar RAT'
    - 'Rhysida Ransomware'
    - 'DarkCrystal RAT'
    - 'Qakbot'
    - 'Snake Keylogger'
    - 'China-Nexus Threat Activity'
    - 'IcedID'
    - 'CISA AA23-347A'
    - 'Azorult'
    - 'Handala Wiper'
    - 'Crypto Stealer'
    - 'Salt Typhoon'
    - 'Earth Alux'
    - 'Double Zero Destructor'
    - 'Trickbot'
    - 'Cactus Ransomware'
    - 'BlackByte Ransomware'
    - 'SystemBC'
    - 'AcidPour'
    - 'NjRAT'
    - 'Graceful Wipe Out Attack'
    - 'Amadey'
    - 'Derusbi'
    - 'AsyncRAT'
    - 'RedLine Stealer'
    - 'SnappyBee'
    - 'Meduza Stealer'
    - 'WinDealer RAT'
    - 'MoonPeak'
    - 'Interlock Ransomware'
    - 'Interlock Rat'
    - 'NailaoLocker Ransomware'
    - 'PromptLock'
    - 'GhostRedirector IIS Module and Rungan Backdoor'
    - 'Lokibot'
    - 'Castle RAT'
    - 'SesameOp'
    - 'DynoWiper'
    - 'XML Runner Loader'
  asset_type:Endpoint
  mitre_attack_id:
    - 'T1036'
  product:
    - 'Splunk Enterprise'
    - 'Splunk Enterprise Security'
    - 'Splunk Cloud'
  security_domain:endpoint

tests:
 name:'True Positive Test'
 attack_data:
  data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/executables_suspicious_file_path/exec_susp_path2.log
  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
  sourcetype: XmlWinEventLog
manual_test:None