Sigma rule: LOL-Binary Copied From System Directory

Rule

Title

LOL-Binary Copied From System Directory

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2023-08-29

Modified

2025-11-27

File

rules/windows/process_creation/proc_creation_win_susp_copy_system_dir_lolbin.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations.

Log source

product

windows

category

process_creation

Detection

selection_tools_cmd:
    Image|endswith: '\cmd.exe'
    CommandLine|contains: 'copy '
selection_tools_pwsh:
    Image|endswith:
        - '\powershell.exe'
        - '\pwsh.exe'
    CommandLine|contains:
        - 'copy-item'
        - ' copy '
        - 'cpi '
        - ' cp '
selection_tools_other:
    - Image|endswith:
          - '\robocopy.exe'
          - '\xcopy.exe'
    - OriginalFileName:
          - 'robocopy.exe'
          - 'XCOPY.EXE'
selection_target_path:
    CommandLine|contains:
        - '\System32'
        - '\SysWOW64'
        - '\WinSxS'
selection_target_lolbin:
    CommandLine|contains:
        # Note: add more binaries to increase coverage
        - '\bitsadmin.exe'
        - '\calc.exe'
        - '\certutil.exe'
        - '\cmdl32.exe'
        - '\cscript.exe'
        - '\mshta.exe'
        - '\rundll32.exe'
        - '\wscript.exe'
        - '\ie4uinit.exe'
condition: 1 of selection_tools_* and all of selection_target_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.stealth
• attack.t1036.003

MITRE ATT&CK ids this rule names

• T1036.003

Related rules

• fff9d2b7-e11c-4a69-93d3-40ef66189767 (derived)

References

• https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120
• https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html
• https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
• https://www.virustotal.com/gui/file/14e722855605ba78dc1d21153f0e1be90e7528149f2cd2d7d6eba8ef27534bdc/behavior

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_susp_copy_system_dir_lolbin.yml