Executable written into a protected program directory

1title: Executable written into a protected program directory2id: 393c050a-eab2-4223-909d-257aea69ea243status: experimental4description: |5  Matches the binary-modification half of AN0949: a file create or overwrite of6  an .exe, .dll, .sys or .ocx underneath the system directories or the Program7  Files trees, by a writer that is not part of the Windows servicing or8  antimalware update path. The rule is written in the Sysmon-shaped `file_event`9  vocabulary (`TargetFilename`, `Image`); the brief also lists Security 4688 for10  the execution half of the same analytic, which is a different feed with a11  different field set and is not authored here. Path terms use `contains` rather12  than `startswith` so the rule is not pinned to the C: drive. Three limits13  worth stating: Sysmon EventID 11 fires on create and overwrite, so patching an14  existing binary in place — IAT hooking or an entry-point patch — may produce15  no event at all; the excluded-writer list includes msiexec.exe because it is16  the loudest legitimate writer, which also removes MSI-delivered tampering from17  view; and the correlation MITRE describes, a write followed by execution of an18  anomalously signed image inside the `TimeWindow` knob, needs both a join and a19  signature attribute that Sigma has neither of. Sysmon file-create logging is20  scoped entirely by your Sysmon configuration, and the common public configs21  filter most writes under System32 — confirm .exe and .dll creation in these22  paths is included before reading silence as clean.23  UNVERIFIED — derived from MITRE ATT&CK DET0336 and never executed against logs.24references:25  - https://attack.mitre.org/techniques/T155426  - https://attack.mitre.org/detectionstrategies/DET033627author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)28date: 2026-08-1629tags:30  - attack.persistence31  - attack.t155432logsource:33  category: file_event34  product: windows35detection:36  selection:37    TargetFilename|contains:38      - '\Windows\System32\'39      - '\Windows\SysWOW64\'40      - '\Program Files\'41      - '\Program Files (x86)\'42    TargetFilename|endswith:43      - '.exe'44      - '.dll'45      - '.sys'46      - '.ocx'47  filter_servicing_writers:48    Image|endswith:49      - '\TiWorker.exe'50      - '\TrustedInstaller.exe'51      - '\poqexec.exe'52      - '\msiexec.exe'53      - '\wusa.exe'54      - '\MsMpEng.exe'55      - '\MpSigStub.exe'56  condition: selection and not filter_servicing_writers57falsepositives:58  - "Third-party application updaters replacing their own binaries in place — browser, conferencing, PDF reader and language-runtime updaters all write fresh .exe and .dll into their Program Files subdirectory on every release. On a fleet this is a continuous stream and by a wide margin the largest source of matches, which is why MITRE's MonitoredPaths knob is the first thing to tighten: dropping the two Program Files prefixes and keeping only System32 and SysWOW64 raises precision sharply."59  - "Windows servicing performed by writers other than the excluded ones, in particular svchost.exe-hosted service components and DISM or setup running during a feature-on-demand, language-pack or in-place upgrade, all of which legitimately create binaries directly in System32."60  - "Non-MSI installer bootstrappers — setup.exe stubs, NSIS and Inno Setup packages, and vendor bundle installers — which unpack their payload straight into Program Files without ever invoking msiexec.exe."61  - "Endpoint agents that self-update without an installer, such as EDR, backup and monitoring products that download a new build and overwrite their own .exe and .dll under Program Files on a schedule."62level: low