Process Execution From A Potentially Suspicious Folder
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects a potentially suspicious execution from an uncommon folder.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND PROCESSNAME contains ":\Perflogs\,:\Users\All Users\,:\Users\Default\,:\Users\NetworkService\,:\Windows\addins\,:\Windows\debug\,:\Windows\Fonts\,:\Windows\Help\,:\Windows\IME\,:\Windows\Media\,:\Windows\repair\,:\Windows\security\,:\Windows\System32\Tasks\,:\Windows\Tasks\,$Recycle.bin,\config\systemprofile\,\Intel\Logs\,\RSA\MachineKeys" AND (PROCESSNAME notstartswith "C:\Users\Public\IBM\ClientSolutions\Start_Programs" AND (PROCESSNAME notstartswith "C:\Windows\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries" OR PROCESSNAME notendswith "\CitrixReceiverUpdater.exe")) select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Florian Roth (Nextron Systems), Tim Shelton
