Detection rules › Sigma
Execution via WorkFolders.exe
Detects using WorkFolders.exe to execute an arbitrary control.exe
Known false positives
- Legitimate usage of the uncommon Windows Work Folders feature.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule body
title: Execution via WorkFolders.exe
id: 0bbc6369-43e3-453d-9944-cae58821c173
status: test
description: Detects using WorkFolders.exe to execute an arbitrary control.exe
references:
- https://twitter.com/elliotkillick/status/1449812843772227588
author: Maxime Thiebaut (@0xThiebaut)
date: 2021-10-21
modified: 2022-12-25
tags:
- attack.stealth
- attack.t1218
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: '\control.exe'
ParentImage|endswith: '\WorkFolders.exe'
filter:
Image: 'C:\Windows\System32\control.exe'
condition: selection and not filter
falsepositives:
- Legitimate usage of the uncommon Windows Work Folders feature.
level: high
Stages and Predicates
Stage 0: condition
selection and not filterStage 1: selection
selection:
Image|endswith: '\control.exe'
ParentImage|endswith: '\WorkFolders.exe'
Stage 2: not filter
filter:
Image: 'C:\Windows\System32\control.exe'
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
Image | eq | C:\Windows\System32\control.exe | excludes:Image field:"Image" value:"C:\Windows\System32\control.exe" |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Image | ends_with |
| field:"Image" kind:ends_with value:"\control.exe" |
ParentImage | ends_with |
| field:"ParentImage" kind:ends_with value:"\WorkFolders.exe" |