title: Suspicious Process Start Locations
id: 15b75071-74cc-47e0-b4c6-b43744a62a2b
status: test
description: Detects suspicious process run from unusual locations
author: juju4, Jonhnathan Ribeiro, oscd.community
references:
  - https://car.mitre.org/wiki/CAR-2013-05-002
date: 2019/01/16
modified: 2022/01/07
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|contains:
        - ':\RECYCLER\'
        - ':\SystemVolumeInformation\'
    - Image|startswith:
        - 'C:\Windows\Tasks\'
        - 'C:\Windows\debug\'
        - 'C:\Windows\fonts\'
        - 'C:\Windows\help\'
        - 'C:\Windows\drivers\'
        - 'C:\Windows\addins\'
        - 'C:\Windows\cursors\'
        - 'C:\Windows\system32\tasks\'
  condition: selection
falsepositives:
  - False positives depend on scripts and administrative tools used in the monitored environment
level: medium
tags:
  - attack.defense_evasion
  - attack.t1036
  - car.2013-05-002
