{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/suspicious-file-creation/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["persistence","suspicious-file-creation","endpoint"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eAttackers often create executable files (e.g., .exe, .dll, .ps1, .py) in unusual directories as part of their attack operations. This can be a way to establish persistence by placing a malicious script in a startup folder, or it could be a way to execute code while avoiding detection. Standard user directories like AppData, Temp, or Public are common targets because they often have relaxed security controls and are less scrutinized than system directories. This technique allows malicious actors to blend in with normal user activity. This type of behavior can be seen across various attack campaigns, from commodity malware to advanced persistent threats (APTs). Detecting these file creations is crucial for identifying compromised systems.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial Access: The attacker gains initial access through an exploit or social engineering.\u003c/li\u003e\n\u003cli\u003ePrivilege Escalation: The attacker escalates privileges to gain higher-level access to the system.\u003c/li\u003e\n\u003cli\u003ePayload Delivery: The attacker downloads a malicious payload, often a script or executable.\u003c/li\u003e\n\u003cli\u003eSuspicious Directory Creation: The attacker creates a new directory or uses an existing one in a suspicious location like \u003ccode\u003eC:\\Users\\Public\\\u003c/code\u003e, \u003ccode\u003eC:\\Windows\\Temp\\\u003c/code\u003e, or \u003ccode\u003e%AppData%\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eExecutable/Script Creation: The attacker writes the malicious payload (e.g., a PowerShell script, batch file, or compiled executable) to the created or existing directory.\u003c/li\u003e\n\u003cli\u003ePersistence: The attacker creates a scheduled task or modifies a registry key to execute the malicious script or executable automatically on system startup or user login.\u003c/li\u003e\n\u003cli\u003eCommand and Control: The malicious script or executable establishes a connection to a command-and-control server to receive further instructions.\u003c/li\u003e\n\u003cli\u003eLateral Movement/Exfiltration: The attacker uses the compromised system as a pivot point to move laterally within the network or exfiltrate sensitive data.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to arbitrary code execution, potentially giving the attacker control over the compromised system. This can lead to data theft, system compromise, lateral movement within the network, and ultimately, significant business disruption. Depending on the level of access achieved, the attacker may be able to install ransomware, steal sensitive data, or disrupt critical business operations. The number of potential victims is broad, spanning across any organization where users have write access to the aforementioned suspicious directories.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnable file creation monitoring, specifically for the suspicious paths listed in the rules, using tools like Sysmon (logsource category: file_event, product: windows).\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rules provided to your SIEM to detect the creation of executable files in suspicious directories (rules).\u003c/li\u003e\n\u003cli\u003eInvestigate any alerts generated by these rules to determine if the created files are malicious or benign.\u003c/li\u003e\n\u003cli\u003eImplement application control policies to restrict the execution of unauthorized executables in user directories (recommendation).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-08T12:00:00Z","date_published":"2024-01-08T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-08-suspicious-executable-creation/","summary":"Attackers may create executables or scripts in suspicious directories to establish persistence, execute malicious code, or evade detection by blending in with legitimate system activity.","title":"Executable or Script Creation in Suspicious Paths","url":"https://feed.craftedsignal.io/briefs/2024-01-08-suspicious-executable-creation/"}],"language":"en","title":"CraftedSignal Threat Feed - Suspicious-File-Creation","version":"https://jsonfeed.org/version/1.1"}