Sigma rule: Writing Of Malicious Files To The Fonts Folder

Rule

Title

Writing Of Malicious Files To The Fonts Folder

Status

test

Level

medium

Author

Sreeman

Date

2020-04-21

Modified

2022-03-08

File

rules/windows/process_creation/proc_creation_win_susp_hiding_malware_in_fonts_folder.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from.

Log source

product

windows

category

process_creation

Detection

selection_1:
    CommandLine|contains:
        - 'echo'
        - 'copy'
        - 'type'
        - 'file createnew'
        - 'cacls'
selection_2:
    CommandLine|contains: 'C:\Windows\Fonts\'
selection_3:
    CommandLine|contains:
        - '.sh'
        - '.exe'
        - '.dll'
        - '.bin'
        - '.bat'
        - '.cmd'
        - '.js'
        - '.msh'
        - '.reg'
        - '.scr'
        - '.ps'
        - '.vb'
        - '.jar'
        - '.pl'
        - '.inf'
        - '.cpl'
        - '.hta'
        - '.msi'
        - '.vbs'
condition: all of selection_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.stealth
• attack.t1211
• attack.t1059
• attack.persistence
• attack.execution

MITRE ATT&CK ids this rule names

• T1059
• T1211

References

• https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_susp_hiding_malware_in_fonts_folder.yml