SigmaHQ/rules/windows/sysmon/sysmon_susp_exec_folder.yml

title: Executables Started in Suspicious Folder
status: experimental
description: Detects process starts of binaries from a suspicious folder
author: Florian Roth
date: 2017/10/14
reference: 
   - https://github.com/mbevilacqua/appcompatprocessor/blob/master/AppCompatSearch.txt
   - https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses
logsource:
   product: windows
   service: sysmon
detection:
   selection:
      EventID: 1
      Image:
      - 'C:\PerfLogs\*'
      - 'C:\$Recycle.bin\*'
      - 'C:\Intel\Logs\*'
      - 'C:\Users\Default\*'
      - 'C:\Users\Public\*'
      - 'C:\Users\NetworkService\*'
      - 'C:\Windows\Fonts\*'
      - 'C:\Windows\Debug\*'
      - 'C:\Windows\Media\*'
      - 'C:\Windows\Help\*'
      - 'C:\Windows\addins\*'
      - 'C:\Windows\repair\*'
      - 'C:\Windows\security\*'
      - '*\RSA\MachineKeys\*'
      - 'C:\Windows\system32\config\systemprofile\*'
   condition: selection
falsepositives:
    - Unknown
level: high