Executable content written over SMB by the System process

Siemphony@siemphonymediumT1570unverifiedPlaybook · Lateral movement

Detects a tool arriving on a host through a file share. Sysmon attributes a file written by a remote SMB client to the kernel-side System process, so a file-create event whose Image is System and whose name carries an executable or script extension is content that came in over the network rather than something the host produced locally, which is the transfer half of AN0516. Image is matched as the exact string System because that is literally what Sysmon records for PID 4 — an endswith on a path fragment such as '\System' would never fire. The share-access leg is deliberately not used: Security EventID 5140 is already covered for administrative shares by the T1021.002 rule in this corpus, and 5140 names the share but not the file while this event names the file but neither the share nor the remote account. The analytic's second half — execution of the transferred binary within a TimeWindow of the write — is a cross-event join Sigma cannot express and has to be pivoted to by hand, and the destination path is where MITRE's FilePathWhitelist knob applies. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0183, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Executable content written over SMB by the System process2id: af25e265-bec8-45c8-96e4-821fea43b08f3status: experimental4description: |5  Detects a tool arriving on a host through a file share. Sysmon attributes a6  file written by a remote SMB client to the kernel-side System process, so a7  file-create event whose Image is System and whose name carries an executable8  or script extension is content that came in over the network rather than9  something the host produced locally, which is the transfer half of AN0516.10  Image is matched as the exact string System because that is literally what11  Sysmon records for PID 4 — an endswith on a path fragment such as '\System'12  would never fire. The share-access leg is deliberately not used: Security13  EventID 5140 is already covered for administrative shares by the T1021.00214  rule in this corpus, and 5140 names the share but not the file while this15  event names the file but neither the share nor the remote account. The16  analytic's second half — execution of the transferred binary within a17  TimeWindow of the write — is a cross-event join Sigma cannot express and has18  to be pivoted to by hand, and the destination path is where MITRE's19  FilePathWhitelist knob applies.20  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0183, not hand-written and not tested by its author. Any lab result is on this rule's own page.21references:22  - https://attack.mitre.org/techniques/T157023  - https://attack.mitre.org/detectionstrategies/DET018324author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)25date: 2026-08-1626tags:27  - attack.lateral-movement28  - attack.t157029logsource:30  category: file_event31  product: windows32detection:33  selection_remote_writer:34    Image: 'System'35  selection_payload:36    TargetFilename|endswith:37      - '.exe'38      - '.dll'39      - '.sys'40      - '.ps1'41      - '.bat'42      - '.cmd'43      - '.vbs'44      - '.hta'45      - '.scr'46  condition: selection_remote_writer and selection_payload47falsepositives:48  - "Software distribution. Client-push installation and remote deployment tooling copies an installer or a service binary into ADMIN$ before running it, producing exactly this event on every targeted host; in a managed estate this is the single largest source of matches, and MITRE's UserContext knob — the accounts allowed to perform administrative transfers — is where the suppression belongs."49  - "File servers and redirected profiles. On a server hosting home directories, departmental shares or roaming profiles, every user who copies a script or an installer onto a share matches, which makes the rule unusable on that role until the shared paths are excluded."50  - "Backup, imaging and migration agents restoring files onto a remote host, and replication or DFS services that write executable content to a partner server on a fixed schedule."51  - "Ordinary remote administration — a robocopy or xcopy to an admin share while troubleshooting, or a hotfix pushed by hand to a handful of machines, both of which are indistinguishable here from staging a payload."52level: medium

Sentinel · KQL

Run this as a search.

DeviceFileEvents| where (InitiatingProcessFolderPath =~ "System" and (FolderPath endswith ".exe" or FolderPath endswith ".dll" or FolderPath endswith ".sys" or FolderPath endswith ".ps1" or FolderPath endswith ".bat" or FolderPath endswith ".cmd" or FolderPath endswith ".vbs" or FolderPath endswith ".hta" or FolderPath endswith ".scr"))

Splunk · SPL

Run this as a search.

index=* (Image="System" AND (TargetFilename="*.exe" OR TargetFilename="*.dll" OR TargetFilename="*.sys" OR TargetFilename="*.ps1" OR TargetFilename="*.bat" OR TargetFilename="*.cmd" OR TargetFilename="*.vbs" OR TargetFilename="*.hta" OR TargetFilename="*.scr"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.executable) == "system" AND (TO_LOWER(file.path) LIKE "*.exe" OR TO_LOWER(file.path) LIKE "*.dll" OR TO_LOWER(file.path) LIKE "*.sys" OR TO_LOWER(file.path) LIKE "*.ps1" OR TO_LOWER(file.path) LIKE "*.bat" OR TO_LOWER(file.path) LIKE "*.cmd" OR TO_LOWER(file.path) LIKE "*.vbs" OR TO_LOWER(file.path) LIKE "*.hta" OR TO_LOWER(file.path) LIKE "*.scr"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,file_event,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)^System$</field>    <field name="TargetFilename" type="pcre2">(?i)(\.exe$|\.dll$|\.sys$|\.ps1$|\.bat$|\.cmd$|\.vbs$|\.hta$|\.scr$)</field>    <description>Executable content written over SMB by the System process</description>    <mitre>      <id>T1570</id>    </mitre>  </rule></group>

At a glance

Logsource: file_event / windows
Level: medium
Category: lateral_movement_remote_exec
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: af25e265-bec8-45c8-96e4-821fea43b08f

ATT&CKT1570

T1570Lateral Tool Transfer

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 3 fired

Fires on none of the 3 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 3 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1570, evaluated against their file_event events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Populate FilePathWhitelist with the paths entries 1–3 are describing:
Alternatively, scope TargetFilename to the paths an SMB/admin-share write
Pivot manually to T1021.002's Security 5140 rule in this corpus: that rule
Evasion is trivial as written: copy the payload with a benign extension
Build the dropped correlation — execution of the transferred binary within

Declared by the author

Software distribution. Client-push installation and remote deployment tooling copies an installer or a service binary into ADMIN$ before running it, producing exactly this event on every targeted host; in a managed estate this is the single largest source of matches, and MITRE's UserContext knob — the accounts allowed to perform administrative transfers — is where the suppression belongs.
File servers and redirected profiles. On a server hosting home directories, departmental shares or roaming profiles, every user who copies a script or an installer onto a share matches, which makes the rule unusable on that role until the shared paths are excluded.
Backup, imaging and migration agents restoring files onto a remote host, and replication or DFS services that write executable content to a partner server on a fixed schedule.
Ordinary remote administration — a robocopy or xcopy to an admin share while troubleshooting, or a hotfix pushed by hand to a handful of machines, both of which are indistinguishable here from staging a payload.

Lessonlateral movement remote exec

lateral movement remote execAI draft — unreviewed

01 · What this rule detects

AN0516 describes a chain: a suspicious file write over SMB or an admin share, followed by execution of the transferred binary. This rule implements only the write — a Sysmon file-create event whose Image is the literal string System and whose TargetFilename ends in one of nine executable-ish extensions. Sysmon attributes any file a remote SMB client writes to the kernel-side System process (PID 4), so this is the transfer half of AN0516, and only that half; the execution half is a hand pivot, not something this rule can see.

02 · Telemetry you need

Sysmon EventID 11, category: file_event / product: windows, copied verbatim from AN0516. FileCreate is heavily filtered in every widely used community Sysmon config, so an empty result can mean the section excludes these paths rather than that nothing happened — a gap the review flagged as missing from this rule's description. Sentinel has no table modelled for file_event, so three of four backends render.
Of AN0516's three knobs, only FilePathWhitelist maps onto this logsource at all: TimeWindow needs the process-creation join this rule doesn't attempt, and UserContext needs an account field this event doesn't carry.

03 · How the logic works

Two selections, implicitly ANDed. selection_remote_writer matches Image: 'System' as an exact string, not endswith: '\System' — Sysmon records the bare literal for PID 4, so an endswith on a path fragment would never fire; the review credits this as the one thing most authors get wrong. selection_payload matches TargetFilename|endswith against nine values: .exe, .dll, .sys, .ps1, .bat, .cmd, .vbs, .hta, .scr — an author-supplied list, not something MITRE's knobs name directly.

04 · Common false positives

The review calls this out directly: the rule carries no path gate at all, and two of its own four false positives describe it as dominant. Entry 1 — software distribution and remote-deployment tooling pushing an installer into ADMIN$ — is named "the single largest source of matches" in a managed estate. Entry 2 says file servers and redirected-profile hosts make the rule "unusable on that role until the shared paths are excluded." A rule whose top false positive is described that way and still ships at level: medium is a calibration mismatch the review flags directly, and MITRE's FilePathWhitelist knob — the exclusion those two entries are asking for — is not yet populated in this rule.
There's also a missed false positive: local, non-network writes attributed to PID 4. Kernel servicing, crash-dump activity, and third-party filter drivers running in the System context all produce this event with nothing having crossed the network, which the description's "came in over the network" framing quietly excludes but the detection logic does not.

05 · Detection maturity

tier_1: . Derived from a MITRE scaffold with no query logic, never run against a log line.
tier_2: run read-only, rank hits by `TargetFilename` path, and turn the top of that list into the `FilePathWhitelist` exclusion block this rule ships without. Expect deployment tooling near the top on any managed estate.
tier_3: ** add the process_creation join so an alert means transfer-then-execution, not any write PID 4 happened to make.

Related detections5 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/af25e265-bec8-45c8-96e4-821fea43b08f

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Executable content written over SMB by the System process

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it