From 3cb0640192015ce8dc8f87cd5e4676aeb2b5ddcf Mon Sep 17 00:00:00 2001
From: frack113 <62423083+frack113@users.noreply.github.com>
Date: Wed, 9 Mar 2022 20:56:35 +0100
Subject: [PATCH] Add file_event_win_susp_dropper

---
 .../file_event_win_susp_dropper.yml           | 23 +++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 rules/windows/file_event/file_event_win_susp_dropper.yml

diff --git a/rules/windows/file_event/file_event_win_susp_dropper.yml b/rules/windows/file_event/file_event_win_susp_dropper.yml
new file mode 100644
index 000000000..7efd9e723
--- /dev/null
+++ b/rules/windows/file_event/file_event_win_susp_dropper.yml
@@ -0,0 +1,23 @@
+title: Suspicious Creation Of a Exe By a Exe
+id: 297afac9-5d02-4138-8c58-b977bac60556
+status: experimental
+description: A executable drop another executable
+author: frack113
+references:
+  - Malware Sandbox
+date: 2022/03/09
+logsource:
+  product: windows
+  category: file_event
+detection:
+  selection:
+    Image|endswith: '.exe'
+    TargetFilename|endswith: '.exe'
+  condition: selection 
+falsepositives:
+  - Unknown
+#Please contribute to FP to go up the level
+level: low
+tags:
+  - attack.resource_development
+  - attack.t1587.001