Detection rules › Splunk
Windows Process Outside of System Folder (Sysmon)
Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by giving it the name of a legitimate, trusted program (ex: svchost.exe). This use case detects Windows processes commonly targeted for abuse operating outside of expected file paths \Windows\system32 and \Windows\SysWOW64
MITRE ATT&CK coverage
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
id: '13077.18833'
title: Windows Process Outside of System Folder
description: 'Adversaries may match or approximate the name or location of legitimate
files or resources when naming/placing them. This is done for the sake of evading
defenses and observation. This may be done by giving it the name of a legitimate,
trusted program (ex: svchost.exe). This use case detects Windows processes commonly
targeted for abuse operating outside of expected file paths \Windows\system32 and
\Windows\SysWOW64. -- Threat Actor Association: Flax Typhoon, Vice Society, UNC4990
- Software Association: XWorm -- Atomics T1036.005 Test #2 Atomics T1218 Test #12'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "EventID>1<")
("svchost.exe" OR "rundll32.exe" OR "services.exe" OR "powershell.exe" OR "pwsh.exe"
OR "regsvr32.exe" OR "spoolsv.exe" OR "lsass.exe" OR "smss.exe" OR "csrss.exe" OR
"conhost.exe" OR "wininit.exe" OR "lsm.exe" OR "winlogon.exe" OR "taskhost.exe"
OR "taskmgr.exe" OR "sihost.exe" OR "RuntimeBroker.exe" OR "smartscreen.exe" OR
"dllhost.exe" OR "audiodg.exe" OR "wlanext.exe" OR "cmd.exe" OR "wmiprvse.exe" OR
"powershell_ise.exe" OR "ie4uinit.exe" OR "mshta.exe" OR "printui.exe") | regex process_path!="(?i)(\x5cWindows\x5c(system32|SysWOW64))|Program\sFiles\x5cPowerShell"|
where match(process_name, "(?i)^(svchost\.exe|rundll32\.exe|services\.exe|powershell\.exe|pwsh\.exe|regsvr32\.exe|spoolsv\.exe|lsass\.exe|smss\.exe|csrss\.exe|conhost\.exe|wininit\.exe|lsm\.exe|winlogon\.exe|taskhost\.exe|taskmgr\.exe|sihost\.exe|RuntimeBroker\.exe|smartscreen\.exe|dllhost\.exe|audiodg\.exe|wlanext\.exe|cmd\.exe|wmiprvse\.exe|powershell_ise\.exe|ie4uinit\.exe|mshta\.exe|printui\.exe)$")
| table _time, host, user, process, process_* | bin span=1s | stats values(*) as
* by _time, host '
techniques:
- defense-evasion:masquerading:masquerade task or service
- defense-evasion:masquerading:match legitimate name or location
technique_id:
- T1036.004
- T1036.005
data_category:
- Windows Sysmon
references:
- https://redcanary.com/threat-detection-report/techniques/match-legitimate-name-or-location/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.005/T1036.005.md#atomic-test-2---masquerade-as-a-built-in-system-executable
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "EventID>1<") ("svchost.exe" OR "rundll32.exe" OR "services.exe" OR "powershell.exe" OR "pwsh.exe" OR "regsvr32.exe" OR "spoolsv.exe" OR "lsass.exe" OR "smss.exe" OR "csrss.exe" OR "conhost.exe" OR "wininit.exe" OR "lsm.exe" OR "winlogon.exe" OR "taskhost.exe" OR "taskmgr.exe" OR "sihost.exe" OR "RuntimeBroker.exe" OR "smartscreen.exe" OR "dllhost.exe" OR "audiodg.exe" OR "wlanext.exe" OR "cmd.exe" OR "wmiprvse.exe" OR "powershell_ise.exe" OR "ie4uinit.exe" OR "mshta.exe" OR "printui.exe")
Stage 2: regex
| regex process_path!="(?i)(\x5cWindows\x5c(system32|SysWOW64))|Program\sFiles\x5cPowerShell"
Stage 3: where
| where match(process_name, "(?i)^(svchost\.exe|rundll32\.exe|services\.exe|powershell\.exe|pwsh\.exe|regsvr32\.exe|spoolsv\.exe|lsass\.exe|smss\.exe|csrss\.exe|conhost\.exe|wininit\.exe|lsm\.exe|winlogon\.exe|taskhost\.exe|taskmgr\.exe|sihost\.exe|RuntimeBroker\.exe|smartscreen\.exe|dllhost\.exe|audiodg\.exe|wlanext\.exe|cmd\.exe|wmiprvse\.exe|powershell_ise\.exe|ie4uinit\.exe|mshta\.exe|printui\.exe)$")
Stage 4: table
| table _time, host, user, process, process_*
Stage 5: bucket
| bin span=1s
Stage 6: stats
| stats values(*) as * by _time, host
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
process_path | regex_match | "(?i)(\x5cWindows\x5c(system32|SysWOW64)), Program\sFiles\x5cPowerShell" |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
process_name | match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "EventID>1<" |
| 1 | "svchost.exe" |
| 1 | "rundll32.exe" |
| 1 | "services.exe" |
| 1 | "powershell.exe" |
| 1 | "pwsh.exe" |
| 1 | "regsvr32.exe" |
| 1 | "spoolsv.exe" |
| 1 | "lsass.exe" |
| 1 | "smss.exe" |
| 1 | "csrss.exe" |
| 1 | "conhost.exe" |
| 1 | "wininit.exe" |
| 1 | "lsm.exe" |
| 1 | "winlogon.exe" |
| 1 | "taskhost.exe" |
| 1 | "taskmgr.exe" |
| 1 | "sihost.exe" |
| 1 | "RuntimeBroker.exe" |
| 1 | "smartscreen.exe" |
| 1 | "dllhost.exe" |
| 1 | "audiodg.exe" |
| 1 | "wlanext.exe" |
| 1 | "cmd.exe" |
| 1 | "wmiprvse.exe" |
| 1 | "powershell_ise.exe" |
| 1 | "ie4uinit.exe" |
| 1 | "mshta.exe" |
| 1 | "printui.exe" |