LOL-Binary Copied From System Directory

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1036.003` Masquerading: Rename Legitimate Utilities

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: LOL-Binary Copied From System Directory
id: f5d19838-41b5-476c-98d8-ba8af4929ee2
related:
    - id: fff9d2b7-e11c-4a69-93d3-40ef66189767
      type: derived
status: test
description: |
    Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations.
references:
    - https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120
    - https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html
    - https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
    - https://www.virustotal.com/gui/file/14e722855605ba78dc1d21153f0e1be90e7528149f2cd2d7d6eba8ef27534bdc/behavior
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-08-29
modified: 2025-11-27
tags:
    - attack.stealth
    - attack.t1036.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_tools_cmd:
        Image|endswith: '\cmd.exe'
        CommandLine|contains: 'copy '
    selection_tools_pwsh:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'copy-item'
            - ' copy '
            - 'cpi '
            - ' cp '
    selection_tools_other:
        - Image|endswith:
              - '\robocopy.exe'
              - '\xcopy.exe'
        - OriginalFileName:
              - 'robocopy.exe'
              - 'XCOPY.EXE'
    selection_target_path:
        CommandLine|contains:
            - '\System32'
            - '\SysWOW64'
            - '\WinSxS'
    selection_target_lolbin:
        CommandLine|contains:
            # Note: add more binaries to increase coverage
            - '\bitsadmin.exe'
            - '\calc.exe'
            - '\certutil.exe'
            - '\cmdl32.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\wscript.exe'
            - '\ie4uinit.exe'
    condition: 1 of selection_tools_* and all of selection_target_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

1 of selection_tools_* and all of selection_target_*

Stage 1: `selection_tools_cmd`

selection_tools_cmd:
    Image|endswith: '\cmd.exe'
    CommandLine|contains: 'copy '

Stage 2: `selection_tools_pwsh`

selection_tools_pwsh:
    Image|endswith:
        - '\powershell.exe'
        - '\pwsh.exe'
    CommandLine|contains:
        - 'copy-item'
        - ' copy '
        - 'cpi '
        - ' cp '

Stage 3: `selection_tools_other`

selection_tools_other:
    - Image|endswith:
          - '\robocopy.exe'
          - '\xcopy.exe'
    - OriginalFileName:
          - 'robocopy.exe'
          - 'XCOPY.EXE'

Stage 4: `selection_target_path`

selection_target_path:
    CommandLine|contains:
        - '\System32'
        - '\SysWOW64'
        - '\WinSxS'

Stage 5: `selection_target_lolbin`

selection_target_lolbin:
    CommandLine|contains:
        - '\bitsadmin.exe'
        - '\calc.exe'
        - '\certutil.exe'
        - '\cmdl32.exe'
        - '\cscript.exe'
        - '\mshta.exe'
        - '\rundll32.exe'
        - '\wscript.exe'
        - '\ie4uinit.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`copy` corpus 4 (sigma 4) `cp` corpus 8 (sigma 6, elastic 1, chronicle 1) `\SysWOW64` `\System32` `\WinSxS` `\bitsadmin.exe` `\calc.exe` `\certutil.exe` `\cmdl32.exe` `\cscript.exe` `\ie4uinit.exe` `\mshta.exe` `\rundll32.exe` `\wscript.exe` `copy` corpus 12 (sigma 11, chronicle 1) `copy-item` corpus 6 (sigma 5, chronicle 1) `cpi` corpus 5 (sigma 4, chronicle 1)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\cmd.exe` corpus 130 (sigma 130) `\powershell.exe` corpus 179 (sigma 178, kusto 1) `\pwsh.exe` corpus 165 (sigma 164, kusto 1) `\robocopy.exe` corpus 4 (sigma 4) `\xcopy.exe` corpus 5 (sigma 5)	`field:"Image" kind:ends_with`
`OriginalFileName`	eq	`XCOPY.EXE` corpus 5 (sigma 4, elastic 1) `robocopy.exe` corpus 4 (sigma 4)	`field:"OriginalFileName" kind:eq`

LOL-Binary Copied From System Directory

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_tools_cmd

Stage 2: selection_tools_pwsh

Stage 3: selection_tools_other

Stage 4: selection_target_path