Detection rules › Sigma
Suspicious Copy From or To System Directory
Detects a suspicious copy operation that tries to copy a program from system (System32, SysWOW64, WinSxS) directories to another on disk. Often used to move LOLBINs such as 'certutil' or 'desktopimgdownldr' to a different location with a different name in order to bypass detections based on locations.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1036.003 Masquerading: Rename Legitimate Utilities |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
title: Suspicious Copy From or To System Directory
id: fff9d2b7-e11c-4a69-93d3-40ef66189767
related:
- id: 855bc8b5-2ae8-402e-a9ed-b889e6df1900
type: derived
status: test
description: |
Detects a suspicious copy operation that tries to copy a program from system (System32, SysWOW64, WinSxS) directories to another on disk.
Often used to move LOLBINs such as 'certutil' or 'desktopimgdownldr' to a different location with a different name in order to bypass detections based on locations.
references:
- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120
- https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html
- https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems)
date: 2020-07-03
modified: 2026-03-16
tags:
- attack.stealth
- attack.t1036.003
logsource:
category: process_creation
product: windows
detection:
selection_img_cmd:
Image|endswith: '\cmd.exe'
CommandLine|contains: 'copy '
selection_img_pwsh:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
CommandLine|contains:
- 'copy-item'
- ' copy '
- 'cpi '
- ' cp '
selection_img_other:
- Image|endswith:
- '\robocopy.exe'
- '\xcopy.exe'
- OriginalFileName:
- 'robocopy.exe'
- 'XCOPY.EXE'
selection_target:
CommandLine|re|i: \s['"]?C:\\Windows\\(?:System32|SysWOW64|WinSxS)
filter_optional_avira:
Image|endswith: '\cmd.exe'
CommandLine|contains|all:
- '/c copy'
- '\Temp\'
- '\avira_system_speedup.exe'
CommandLine|contains:
- 'C:\Program Files\Avira\'
- 'C:\Program Files (x86)\Avira\'
condition: 1 of selection_img_* and selection_target and not 1 of filter_optional_*
falsepositives:
- Depend on scripts and administrative tools used in the monitored environment (For example an admin scripts like https://www.itexperience.net/sccm-batch-files-and-32-bits-processes-on-64-bits-os/)
- When cmd.exe and xcopy.exe are called directly # C:\Windows\System32\cmd.exe /c copy file1 file2
- When the command contains the keywords but not in the correct order
level: medium
Stages and Predicates
Stage 0: condition
1 of selection_img_* and selection_target and not 1 of filter_optional_*Stage 1: selection_img_cmd
selection_img_cmd:
Image|endswith: '\cmd.exe'
CommandLine|contains: 'copy '
Stage 2: selection_img_pwsh
selection_img_pwsh:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
CommandLine|contains:
- 'copy-item'
- ' copy '
- 'cpi '
- ' cp '
Stage 3: selection_img_other
selection_img_other:
- Image|endswith:
- '\robocopy.exe'
- '\xcopy.exe'
- OriginalFileName:
- 'robocopy.exe'
- 'XCOPY.EXE'
Stage 4: selection_target
selection_target:
CommandLine|re|i: \s['"]?C:\\Windows\\(?:System32|SysWOW64|WinSxS)
Stage 5: not filter_optional_avira
filter_optional_avira:
Image|endswith: '\cmd.exe'
CommandLine|contains|all:
- '/c copy'
- '\Temp\'
- '\avira_system_speedup.exe'
CommandLine|contains:
- 'C:\Program Files\Avira\'
- 'C:\Program Files (x86)\Avira\'
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
CommandLine | match | C:\Program Files (x86)\Avira\ |
CommandLine | match | C:\Program Files\Avira\ |
CommandLine | match | /c copy |
CommandLine | match | \Temp\ |
CommandLine | match | \avira_system_speedup.exe |
Image | ends_with | \cmd.exe |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CommandLine | match |
|
CommandLine | regex_match |
|
Image | ends_with |
|
OriginalFileName | eq |
|