title: File Created with System Process Name
id: d5866ddf-ce8f-4aea-b28e-d96485a20d3d
status: test
description: Detects the creation of an executable with a system process name in a suspicious folder
author: Sander Wiebing, Tim Shelton
date: 2020/05/26
modified: 2022/02/22
tags:
    - attack.defense_evasion
    - attack.t1036.005
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith:
            - '\svchost.exe'
            - '\rundll32.exe'
            - '\services.exe'
            - '\powershell.exe'
            - '\regsvr32.exe'
            - '\spoolsv.exe'
            - '\lsass.exe'
            - '\smss.exe'
            - '\csrss.exe'
            - '\conhost.exe'
            - '\wininit.exe'
            - '\lsm.exe'
            - '\winlogon.exe'
            - '\explorer.exe'
            - '\taskhost.exe'
            - '\Taskmgr.exe'
            - '\taskmgr.exe'
            - '\sihost.exe'
            - '\RuntimeBroker.exe'
            - '\runtimebroker.exe'
            - '\smartscreen.exe'
            - '\dllhost.exe'
            - '\audiodg.exe'
            - '\wlanext.exe'
    filter1:
        TargetFilename|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\system32\'
            - 'C:\Windows\SysWow64\'
            - 'C:\Windows\SysWOW64\'
            - 'C:\Windows\winsxs\'
            - 'C:\Windows\WinSxS\'
            - '\SystemRoot\System32\'
        Image|endswith: 
            - '\Windows\System32\dism.exe'
            - '\TiWorker.exe'
    filter2:
        TargetFilename|startswith: 'C:\$WINDOWS.~BT\'
        Image: 'C:\$WINDOWS.~BT\Sources\SetupHost.exe'
    filter3:
        TargetFilename|endswith: '\RuntimeBroker.exe'
        Image: 'C:\Windows\system32\wbengine.exe'
    condition: selection and not 1 of filter*
fields:
    - Image
falsepositives:
    - System processes copied outside the default folder
level: high
