Creation Exe for Service with Unquoted Path

Status: test
Severity: high
Log source: category file_event, product windows
Author: frack113
Source: github.com/SigmaHQ/sigma

Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1547.009` Boot or Logon Autostart Execution: Shortcut Modification
Privilege Escalation	`T1547.009` Boot or Logon Autostart Execution: Shortcut Modification

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule body

title: Creation Exe for Service with Unquoted Path
id: 8c3c76ca-8f8b-4b1d-aaf3-81aebcd367c9
status: test
description: |
    Adversaries may execute their own malicious payloads by hijacking vulnerable file path references.
    Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.009/T1574.009.md
author: frack113
date: 2021-12-30
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1547.009
logsource:
    product: windows
    category: file_event
detection:
    selection:
        # Feel free to add more
        TargetFilename: 'C:\program.exe'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    TargetFilename: 'C:\program.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetFilename`	eq	`C:\program.exe`	`field:"TargetFilename" kind:eq value:"C:\program.exe"`