title: Executables Started in Suspicious Folder
status: experimental
description: Detects process starts of binaries from a suspicious folder
author: Florian Roth
date: 2017/10/14
references:
   - https://github.com/mbevilacqua/appcompatprocessor/blob/master/AppCompatSearch.txt
   - https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses
logsource:
   product: windows
   service: sysmon
detection:
   selection:
      EventID: 1
      Image:
         - 'C:\PerfLogs\\*'
         - 'C:\$Recycle.bin\\*'
         - 'C:\Intel\Logs\\*'
         - 'C:\Users\Default\\*'
         - 'C:\Users\Public\\*'
         - 'C:\Users\NetworkService\\*'
         - 'C:\Windows\Fonts\\*'
         - 'C:\Windows\Debug\\*'
         - 'C:\Windows\Media\\*'
         - 'C:\Windows\Help\\*'
         - 'C:\Windows\addins\\*'
         - 'C:\Windows\repair\\*'
         - 'C:\Windows\security\\*'
         - '*\RSA\MachineKeys\\*'
         - 'C:\Windows\system32\config\systemprofile\\*'
   condition: selection
falsepositives:
    - Unknown
level: high