Non-installer process writes an executable into System32 or SysWOW64

1title: Non-installer process writes an executable into System32 or SysWOW642id: 5de03204-020d-42c2-bd23-a633c0a733763status: experimental4description: |5  AN1211 describes a service binary being overwritten because the file or its6  containing directory has weak permissions, then that binary running under7  the service's own elevated context. Sysmon EID 11 (file_event, the logsource8  used here) can see only the write half of that story — it has no service9  name, no ACL and no privilege field — so this rule is a coarse proxy: an10  executable or DLL created or modified under System32 or SysWOW64, the two11  directories that host the large majority of built-in Windows service12  binaries, by a process outside a short allowlist of legitimate servicing13  tools (Windows Installer, TrustedInstaller, the servicing worker and the14  standalone update installer). It cannot confirm the written file backs a15  registered service, and it cannot see the later execution under elevated16  privileges that AN1211's second half describes — that is a Sysmon EID17  11-to-EID 1 join on path and time window, which lib/sigma has no construct18  for. MITRE's MonitoredServices and HashBaseline knobs (a specific service19  list and known-good hashes) are not populated at all, because neither is20  something this pipeline can source generically; PrivilegedAccounts becomes21  the filter_trusted_writer allowlist below, authored here rather than taken22  from MITRE. Prerequisite: this fires only where the Sysmon configuration in23  use actually captures EID 11 for these paths — a config that filters file24  events by extension or excludes system directories produces zero rows here25  regardless of what is happening on disk.26  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0436, not hand-written and not tested by its author. Any lab result is on this rule's own page.27references:28  - https://attack.mitre.org/techniques/T1574/01029  - https://attack.mitre.org/detectionstrategies/DET043630author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)31date: 2026-08-1732tags:33  - attack.defense-evasion34  - attack.execution35  - attack.t1574.01036logsource:37  category: file_event38  product: windows39detection:40  selection_target:41    TargetFilename|endswith:42      - '.exe'43      - '.dll'44  selection_service_dir:45    TargetFilename|contains:46      - '\System32\'47      - '\SysWOW64\'48  filter_trusted_writer:49    Image|startswith:50      - 'C:\Windows\System32\msiexec.exe'51      - 'C:\Windows\servicing\TrustedInstaller.exe'52      - 'C:\Windows\System32\wusa.exe'53  filter_trusted_writer_tiworker:54    Image|endswith: '\TiWorker.exe'55  condition: selection_target and selection_service_dir and not 1 of filter_trusted_writer*56falsepositives:57  - "Routine Windows Update or cumulative-update servicing: TiWorker.exe hardlinks updated components from the WinSxS store into System32 and SysWOW64 on every patch cycle, on every Windows host — this is filtered by process name only, since TiWorker.exe itself runs from a versioned WinSxS servicing-stack subdirectory rather than System32, so no fixed startswith path for it is reliable."58  - "Non-Microsoft installers or portable deployment tools that are mis-packaged to drop DLLs directly into System32 or SysWOW64 instead of their own Program Files directory, writing through a process outside the msiexec/TrustedInstaller/TiWorker/wusa allowlist."59  - "Endpoint security, backup or RMM agents that legitimately update helper DLLs placed in System32 or SysWOW64 through their own vendor updater process rather than through Windows Installer or servicing."60  - "OEM or third-party signed driver package installers that copy .dll or support-file executables into System32 or SysWOW64 during hardware setup, run by the vendor's own setup binary rather than msiexec."61level: medium