Sigma rule: Windows Binaries Write Suspicious Extensions

Rule

Title

Windows Binaries Write Suspicious Extensions

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-08-12

Modified

2025-10-07

File

rules/windows/file/file_event/file_event_win_shell_write_susp_files_extensions.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects Windows executables that write files with suspicious extensions

Log source

product

windows

category

file_event

Detection

selection_generic:
    Image|endswith:
        - '\csrss.exe'
        - '\lsass.exe'
        - '\RuntimeBroker.exe'
        - '\sihost.exe'
        - '\smss.exe'
        - '\wininit.exe'
        - '\winlogon.exe'
    TargetFilename|endswith:
        - '.bat'
        - '.dll'
        - '.exe'
        - '.hta'
        - '.iso'
        - '.ps1'
        - '.txt'
        - '.vbe'
        - '.vbs'
selection_special:
    Image|endswith:
        - '\dllhost.exe'
        - '\rundll32.exe'
        - '\svchost.exe'
    TargetFilename|endswith:
        - '.bat'
        - '.hta'
        - '.iso'
        - '.ps1'
        - '.vbe'
        - '.vbs'
filter_main_AppLockerPolicyTest:
    Image: 'C:\Windows\System32\dllhost.exe'
    TargetFilename|contains|all:
        - ':\Users\'
        - '\AppData\Local\Temp\__PSScriptPolicyTest_'
    TargetFilename|endswith: '.ps1'
filter_main_script_gpo_machine:
    Image: 'C:\Windows\system32\svchost.exe'
    TargetFilename|contains|all:
        - 'C:\Windows\System32\GroupPolicy\DataStore\'
        - '\sysvol\'
        - '\Policies\'
        - '\Machine\Scripts\Startup\'
    TargetFilename|endswith:
        - '.ps1'
        - '.bat'
filter_main_clipchamp:
    Image: 'C:\Windows\system32\svchost.exe'
    TargetFilename|contains|all:
        - 'C:\Program Files\WindowsApps\Clipchamp'
        - '.ps1'
filter_main_powershell_preview:
    Image:
        - 'C:\Windows\system32\svchost.exe'
        - 'C:\Windows\SysWOW64\svchost.exe'
    TargetFilename|startswith:
        - 'C:\Program Files\WindowsApps\Microsoft.PowerShellPreview'
        - 'C:\Program Files (x86)\WindowsApps\Microsoft.PowerShellPreview'
    TargetFilename|endswith: '.ps1'
condition: 1 of selection_* and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.stealth
• attack.t1036

MITRE ATT&CK ids this rule names

• T1036

Related rules

• 1277f594-a7d1-4f28-a2d3-73af5cbeab43 (derived)

References

• Internal Research

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_shell_write_susp_files_extensions.yml