Detection rules › Splunk
Process Execution From Suspicious Folder (Windows Event Log)
Threat actors may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and security tools. Masquerading involves altering the name or location of an object, whether legitimate or malicious, to evade defenses and avoid detection. This technique can include modifying file metadata, misleading users about the file type, and using names that resemble legitimate tasks or services. This use case detects processes executed from a suspicious folder.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1036 Masquerading |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '33791.59818'
title: Process Execution From Suspicious Folder
description: Threat actors may attempt to manipulate features of their artifacts to
make them appear legitimate or benign to users and security tools. Masquerading
involves altering the name or location of an object, whether legitimate or malicious,
to evade defenses and avoid detection. This technique can include modifying file
metadata, misleading users about the file type, and using names that resemble legitimate
tasks or services. This use case detects processes executed from a suspicious folder.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) ("\\$Recycle.bin\\" OR "\\config\\systemprofile\\"
OR "\\Intel\\Logs\\" OR "\\RSA\\MachineKeys\\" OR ("\\Users\\" ("\\Public\\" OR
"\\All Users\\" OR "\\Default\\" OR "\\NetworkService\\")) OR ("\\Windows\\" ("\\addins\\"
OR "\\debug\\" OR "\\Fonts\\" OR "\\Help\\" OR "\\IME\\" OR "\\Media\\" OR "\\repair\\"
OR "\\security\\" OR "\\System32\\Tasks\\" OR "\\Tasks\\")) OR "C:\\Perflogs\\")
OR "\\Users\\Public" | regex process_path="(?i)(\x5c\$Recycle\.bin\x5c|\x5cconfig\x5csystemprofile\x5c|\x5cIntel\x5cLogs\x5c|\x5cRSA\x5cMachineKeys\x5c)|(\x5cUsers\x5c(Public|All\s+Users|Default|NetworkService)\x5c)|(\x5cWindows\x5c(addins|debug|Fonts|Help|IME|Media|repair|security|System32\x5cTasks|Tasks)\x5c)|^C:\x5cPerflogs\x5c"|
regex parent_process_path!="(?i)(^C:\x5cUsers\x5cPublic\x5cIBM\x5cClientSolutions\x5cStart_Programs\x5c)"|
regex parent_process_path!="(?i)(^C:\x5cWindows\x5cSysWOW64\x5cconfig\x5csystemprofile\x5cCitrix\x5cUpdaterBinaries\x5c\S+\CitrixReceiverUpdater\.exe)"
| table _time, host, user, process, parent_*, process_* | bin span=1s | stats values(*)
as * by _time, host '
techniques:
- defense-evasion:masquerading
technique_id:
- T1036
data_category:
- Windows event logs
references:
- https://attack.mitre.org/techniques/T1036/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_execution_path.yml
- https://blogs.blackberry.com/en/2023/07/decoding-romcom-behaviors-and-opportunities-for-detection
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) ("\\$Recycle.bin\\" OR "\\config\\systemprofile\\" OR "\\Intel\\Logs\\" OR "\\RSA\\MachineKeys\\" OR ("\\Users\\" ("\\Public\\" OR "\\All Users\\" OR "\\Default\\" OR "\\NetworkService\\")) OR ("\\Windows\\" ("\\addins\\" OR "\\debug\\" OR "\\Fonts\\" OR "\\Help\\" OR "\\IME\\" OR "\\Media\\" OR "\\repair\\" OR "\\security\\" OR "\\System32\\Tasks\\" OR "\\Tasks\\")) OR "C:\\Perflogs\\") OR "\\Users\\Public"
Stage 2: regex
| regex process_path="(?i)(\x5c\$Recycle\.bin\x5c|\x5cconfig\x5csystemprofile\x5c|\x5cIntel\x5cLogs\x5c|\x5cRSA\x5cMachineKeys\x5c)|(\x5cUsers\x5c(Public|All\s+Users|Default|NetworkService)\x5c)|(\x5cWindows\x5c(addins|debug|Fonts|Help|IME|Media|repair|security|System32\x5cTasks|Tasks)\x5c)|^C:\x5cPerflogs\x5c"
Stage 3: regex
| regex parent_process_path!="(?i)(^C:\x5cUsers\x5cPublic\x5cIBM\x5cClientSolutions\x5cStart_Programs\x5c)"
Stage 4: regex
| regex parent_process_path!="(?i)(^C:\x5cWindows\x5cSysWOW64\x5cconfig\x5csystemprofile\x5cCitrix\x5cUpdaterBinaries\x5c\S+\CitrixReceiverUpdater\.exe)"
Stage 5: table
| table _time, host, user, process, parent_*, process_*
Stage 6: bucket
| bin span=1s
Stage 7: stats
| stats values(*) as * by _time, host
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
parent_process_path | regex_match | "(?i)(^C:\x5cUsers\x5cPublic\x5cIBM\x5cClientSolutions\x5cStart_Programs\x5c)" |
parent_process_path | regex_match | "(?i)(^C:\x5cWindows\x5cSysWOW64\x5cconfig\x5csystemprofile\x5cCitrix\x5cUpdaterBinaries\x5c\S+\CitrixReceiverUpdater.exe)" |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
process_path | regex_match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | "\\$Recycle.bin\\" |
| 1 | "\\config\\systemprofile\\" |
| 1 | "\\Intel\\Logs\\" |
| 1 | "\\RSA\\MachineKeys\\" |
| 1 | "\\Users\\" |
| 1 | "\\Public\\" |
| 1 | "\\All Users\\" |
| 1 | "\\Default\\" |
| 1 | "\\NetworkService\\" |
| 1 | "\\Windows\\" |
| 1 | "\\addins\\" |
| 1 | "\\debug\\" |
| 1 | "\\Fonts\\" |
| 1 | "\\Help\\" |
| 1 | "\\IME\\" |
| 1 | "\\Media\\" |
| 1 | "\\repair\\" |
| 1 | "\\security\\" |
| 1 | "\\System32\\Tasks\\" |
| 1 | "\\Tasks\\" |
| 1 | "C:\\Perflogs\\" |
| 1 | "\\Users\\Public" |