Suspicious Program Names

SIGMA detection rule by Florian Roth (Nextron Systems) · GPL-2.0

Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools

title: Suspicious Program Names
id: 9c2f40db-46e4-85f0-3104-427e61b344a1
related:
    - id: efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6
      type: derived
status: test
description: Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md
author: Florian Roth (Nextron Systems)
date: 2022-02-11
modified: 2023-03-22
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    process_creation:
        EventID: 4688
        Channel: Security
    selection_image:
        - NewProcessName|contains:
              - \CVE-202   # Update this when we reach the year 2100
              - \CVE202   # Update this when we reach the year 2100
        - NewProcessName|endswith:
              - \poc.exe
              - \artifact.exe
              - \artifact64.exe
              - \artifact_protected.exe
              - \artifact32.exe
              - \artifact32big.exe
              - obfuscated.exe
              - obfusc.exe
              - \meterpreter
    selection_commandline:
        CommandLine|contains:
            - inject.ps1
            - Invoke-CVE
            - pupy.ps1
            - payload.ps1
            - beacon.ps1
            - PowerView.ps1
            - bypass.ps1
            - obfuscated.ps1
            - obfusc.ps1
            - obfus.ps1
            - obfs.ps1
            - evil.ps1
            - MiniDogz.ps1
            - _enc.ps1
            - \shell.ps1
            - \rshell.ps1
            - revshell.ps1
            - \av.ps1
            - \av_test.ps1
            - adrecon.ps1
            - mimikatz.ps1
            - \PowerUp_
            - powerup.ps1
            - \Temp\a.ps1
            - \Temp\p.ps1
            - \Temp\1.ps1
            - Hound.ps1
            - encode.ps1
            - powercat.ps1
    condition: process_creation and (1 of selection*)
falsepositives:
    - Legitimate tools that accidentally match on the searched patterns
level: high
ruletype: Sigma

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

4e2377e9-d15d-4aeb-8b43-29f30f3a5680

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion