Sigma rule: Network Connection Initiated From Users\Public Folder

Rule

Title

Network Connection Initiated From Users\Public Folder

Status

test

Level

medium

Author

Florian Roth (Nextron Systems)

Date

2024-05-31

File

rules-threat-hunting/windows/network_connection/net_connection_win_susp_initaited_public_folder.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects a network connection initiated from a process located in the "C:\Users\Public" folder.
Attacker are known to drop their malicious payloads and malware in this directory as its writable by everyone.
Use this rule to hunt for potential suspicious or uncommon activity in your environement.

Log source

product

windows

category

network_connection

Detection

selection:
    Initiated: 'true'
    Image|contains: ':\Users\Public\'
filter_optional_ibm:
    Image|contains: ':\Users\Public\IBM\ClientSolutions\Start_Programs\' # IBM Client Solutions Default Location (Added by Tim Shelton - https://github.com/SigmaHQ/sigma/pull/3053/files)
condition: selection and not 1 of filter_optional_*

False positives (as the rule lists them)

• Likely from legitimate third party application that execute from the "Public" directory.

Tags

• attack.command-and-control
• attack.t1105
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1105

Related rules

• 7b434893-c57d-4f41-908d-6a17bf1ae98f (derived)

References

• https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/network_connection/net_connection_win_susp_initaited_public_folder.yml