Detection of Legitimate Application File Writes to Suspicious Locations

Adversaries frequently employ Living-off-the-Land Binaries (LOLBins) to execute malicious activities while blending in with legitimate system traffic. By leveraging built-in Windows utilities such as certutil, bitsadmin, or mshta, attackers can download, drop, or manipulate files in unconventional locations. These actions are often used to bypass security solutions that might overlook activity originating from trusted signed binaries. Detecting these patterns requires monitoring file events generated by these specific binaries when they target directories atypical for their normal operational data, such as public writeable folders or system root subdirectories. This approach enables defenders to identify suspicious stage-drop behavior early in the attack chain.

Attack Chain

1. Attacker establishes initial access or presence on a target host.
2. Attacker selects a LOLBin, such as bitsadmin or certutil, to facilitate lateral movement or payload delivery.
3. Attacker uses the chosen binary to reach out to an external network or staging point to retrieve a malicious file.
4. Attacker forces the legitimate binary to write the retrieved content to a specific file path on the local disk.
5. The chosen path (e.g., C:\Users\Public\ or C:\ProgramData\) is selected by the attacker for its write permissions and lower visibility.
6. The file is successfully dropped, potentially followed by execution via another LOLBin to maintain persistence or establish Command and Control (C2).

Impact

Successful execution of these techniques allows attackers to stage malicious payloads, establish persistence in directories like the Startup folder, or exfiltrate sensitive data by masquerading as routine system processes. This behavior has been observed across various sectors as part of initial compromise and post-exploitation phases, often leading to full system compromise or long-term unauthorized access.

Recommendation

• Deploy the provided Sigma rule to your SIEM/EDR to monitor file-system modifications initiated by common LOLBins.
• Enable Windows File System auditing (Event ID 11 for Sysmon) to ensure the necessary telemetry is captured for this detection.
• Review and tune the exclusion list provided in the rule to account for legitimate vendor-specific background tasks, such as Dell TechHub, to reduce noise.