diff --git a/rules/windows/file_event/file_event_win_susp_dropper.yml b/rules/windows/file_event/file_event_win_susp_dropper.yml
new file mode 100644
index 000000000..7efd9e723
--- /dev/null
+++ b/rules/windows/file_event/file_event_win_susp_dropper.yml
@@ -0,0 +1,23 @@
+title: Suspicious Creation Of a Exe By a Exe
+id: 297afac9-5d02-4138-8c58-b977bac60556
+status: experimental
+description: A executable drop another executable
+author: frack113
+references:
+  - Malware Sandbox
+date: 2022/03/09
+logsource:
+  product: windows
+  category: file_event
+detection:
+  selection:
+    Image|endswith: '.exe'
+    TargetFilename|endswith: '.exe'
+  condition: selection 
+falsepositives:
+  - Unknown
+#Please contribute to FP to go up the level
+level: low
+tags:
+  - attack.resource_development
+  - attack.t1587.001