Detection rules › Splunk
Windows Process Copied from System Folder (Sysmon)
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of masquerading. This use case detects copying of files from Windows system folders. Note: These events are only detected when a new process is created, or if PowerShell logging is enabled and used
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule body
id: '14952.22078'
title: Windows Process Copied from System Folder
description: 'Adversaries may attempt to manipulate features of their artifacts to
make them appear legitimate or benign to users and/or security tools. Masquerading
occurs when the name or location of an object, legitimate or malicious, is manipulated
or abused for the sake of evading defenses and observation. This may include manipulating
file metadata, tricking users into misidentifying the file type, and giving legitimate
task or service names. Renaming abusable system utilities to evade security monitoring
is also a form of masquerading. This use case detects copying of files from Windows
system folders. Note: These events are only detected when a new process is created,
or if PowerShell logging is enabled and used. -- Software Association: BATLoader,
DarkGate, XWorm -- Atomics T1036 Test #1 Atomics T1546.008 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<")
(TERM(Copy-Item) OR TERM(copy) OR TERM(xcopy) OR TERM(cp) OR TERM(cpi) OR TERM(robocopy))
AND ("system32" OR "syswow64") | regex process="(?i)(copy-item|copy|xcopy|cp|cpi|robocopy)\s+.+(\x5c(system32|syswow64)\x5c)"
| table _time, host, user, process, process_*, parent_process, parent_process_*,
user | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:masquerading
- defense-evasion:masquerading:rename system utilities
technique_id:
- T1036
- T1036.003
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036/T1036.md
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<") (TERM(Copy-Item) OR TERM(copy) OR TERM(xcopy) OR TERM(cp) OR TERM(cpi) OR TERM(robocopy)) AND ("system32" OR "syswow64")
Stage 2: regex
| regex process="(?i)(copy-item|copy|xcopy|cp|cpi|robocopy)\s+.+(\x5c(system32|syswow64)\x5c)"
Stage 3: table
| table _time, host, user, process, process_*, parent_process, parent_process_*, user
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
process | regex_match |
| field:"CommandLine" kind:regex_match |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "EventCode=1" |
| 1 | "<EventID>1<" |
| 1 | "Copy-Item" |
| 1 | copy |
| 1 | xcopy |
| 1 | cp |
| 1 | cpi |
| 1 | robocopy |
| 1 | "system32" |
| 1 | "syswow64" |