Detection rules › Splunk
Windows Process Copied from System Folder (Sysmon)
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of masquerading. This use case detects copying of files from Windows system folders. Note: These events are only detected when a new process is created, or if PowerShell logging is enabled and used
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1036.003 Masquerading: Rename Legitimate Utilities |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
id: '14952.22078'
title: Windows Process Copied from System Folder
description: 'Adversaries may attempt to manipulate features of their artifacts to
make them appear legitimate or benign to users and/or security tools. Masquerading
occurs when the name or location of an object, legitimate or malicious, is manipulated
or abused for the sake of evading defenses and observation. This may include manipulating
file metadata, tricking users into misidentifying the file type, and giving legitimate
task or service names. Renaming abusable system utilities to evade security monitoring
is also a form of masquerading. This use case detects copying of files from Windows
system folders. Note: These events are only detected when a new process is created,
or if PowerShell logging is enabled and used. -- Software Association: BATLoader,
DarkGate, XWorm -- Atomics T1036 Test #1 Atomics T1546.008 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<")
(TERM(Copy-Item) OR TERM(copy) OR TERM(xcopy) OR TERM(cp) OR TERM(cpi) OR TERM(robocopy))
AND ("system32" OR "syswow64") | regex process="(?i)(copy-item|copy|xcopy|cp|cpi|robocopy)\s+.+(\x5c(system32|syswow64)\x5c)"
| table _time, host, user, process, process_*, parent_process, parent_process_*,
user | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:masquerading
- defense-evasion:masquerading:rename system utilities
technique_id:
- T1036
- T1036.003
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036/T1036.md
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<") (TERM(Copy-Item) OR TERM(copy) OR TERM(xcopy) OR TERM(cp) OR TERM(cpi) OR TERM(robocopy)) AND ("system32" OR "syswow64")
Stage 2: regex
| regex process="(?i)(copy-item|copy|xcopy|cp|cpi|robocopy)\s+.+(\x5c(system32|syswow64)\x5c)"
Stage 3: table
| table _time, host, user, process, process_*, parent_process, parent_process_*, user
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
process | regex_match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | "EventCode=1" |
| 1 | "<EventID>1<" |
| 1 | "Copy-Item" |
| 1 | TERM |
| 1 | copy |
| 1 | TERM |
| 1 | xcopy |
| 1 | TERM |
| 1 | cp |
| 1 | TERM |
| 1 | cpi |
| 1 | TERM |
| 1 | robocopy |
| 1 | "system32" |
| 1 | "syswow64" |