Merge remote-tracking branch 'upstream/master'

rules/windows/sysmon/sysmon_susp_exec_folder.yml

@@ -0,0 +1,35 @@
+title: Executables Started in Suspicious Folder
+status: experimental
+description: Detects process starts of binaries from a suspicious folder
+author: Florian Roth
+date: 2017/10/14
+reference: 
+   - https://github.com/mbevilacqua/appcompatprocessor/blob/master/AppCompatSearch.txt
+   - https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses
+logsource:
+   product: windows
+   service: sysmon
+detection:
+   selection:
+      EventID: 1
+      Image:
+         - 'C:\PerfLogs\*'
+         - 'C:\$Recycle.bin\*'
+         - 'C:\Intel\Logs\*'
+         - 'C:\Users\Default\*'
+         - 'C:\Users\Public\*'
+         - 'C:\Users\NetworkService\*'
+         - 'C:\Windows\Fonts\*'
+         - 'C:\Windows\Debug\*'
+         - 'C:\Windows\Media\*'
+         - 'C:\Windows\Help\*'
+         - 'C:\Windows\addins\*'
+         - 'C:\Windows\repair\*'
+         - 'C:\Windows\security\*'
+         - '*\RSA\MachineKeys\*'
+         - 'C:\Windows\system32\config\systemprofile\*'
+   condition: selection
+falsepositives:
+    - Unknown
+level: high
+