Sigma rule: Suspicious Copy From or To System Directory

Rule

Title

Suspicious Copy From or To System Directory

Status

test

Level

medium

Author

Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems)

Date

2020-07-03

Modified

2026-03-16

File

rules/windows/process_creation/proc_creation_win_susp_copy_system_dir.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects a suspicious copy operation that tries to copy a program from system (System32, SysWOW64, WinSxS) directories to another on disk.
Often used to move LOLBINs such as 'certutil' or 'desktopimgdownldr' to a different location with a different name in order to bypass detections based on locations.

Log source

product

windows

category

process_creation

Detection

selection_img_cmd:
    Image|endswith: '\cmd.exe'
    CommandLine|contains: 'copy '
selection_img_pwsh:
    Image|endswith:
        - '\powershell.exe'
        - '\pwsh.exe'
    CommandLine|contains:
        - 'copy-item'
        - ' copy '
        - 'cpi '
        - ' cp '
selection_img_other:
    - Image|endswith:
          - '\robocopy.exe'
          - '\xcopy.exe'
    - OriginalFileName:
          - 'robocopy.exe'
          - 'XCOPY.EXE'
selection_target:
    CommandLine|re|i: \s['"]?C:\\Windows\\(?:System32|SysWOW64|WinSxS)
filter_optional_avira:
    Image|endswith: '\cmd.exe'
    CommandLine|contains|all:
        - '/c copy'
        - '\Temp\'
        - '\avira_system_speedup.exe'
    CommandLine|contains:
        - 'C:\Program Files\Avira\'
        - 'C:\Program Files (x86)\Avira\'
condition: 1 of selection_img_* and selection_target and not 1 of filter_optional_*

False positives (as the rule lists them)

• Depend on scripts and administrative tools used in the monitored environment (For example an admin scripts like https://www.itexperience.net/sccm-batch-files-and-32-bits-processes-on-64-bits-os/)
• When cmd.exe and xcopy.exe are called directly
• When the command contains the keywords but not in the correct order

Tags

• attack.stealth
• attack.t1036.003

MITRE ATT&CK ids this rule names

• T1036.003

Related rules

• 855bc8b5-2ae8-402e-a9ed-b889e6df1900 (derived)

References

• https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120
• https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html
• https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_susp_copy_system_dir.yml