Synopsis
Activation Period |
14 Days |
Training Period |
30 Days |
Test Period |
N/A (single event) |
Deduplication Period |
1 Day |
Required Data |
|
Detection Modules |
|
Detector Tags |
EDR Windows Disguised Processes |
ATT&CK Tactic |
Defense Evasion (TA0005) |
ATT&CK Technique |
Masquerading (T1036) |
Severity |
Informational |
Description
An attacker may be trying to avoid detection by moving an executable to a Windows system folder.
Attacker's Goals
- An attacker may be trying to avoid detection by moving an executable to a Windows system folder.
Investigative actions
- Check if the file is known in organization or malicious.
- Check if the digital signature of the file is valid and belongs to a known good software vendor.
- Investigate the process which has moved the file to the system folder.
Variations
Rare executable moved to Windows system folder by rare causality actor
Synopsis
Description
An attacker may be trying to avoid detection by moving an executable to a Windows system folder.
Attacker's Goals
- An attacker may be trying to avoid detection by moving an executable to a Windows system folder.
Investigative actions
- Check if the file is known in organization or malicious.
- Check if the digital signature of the file is valid and belongs to a known good software vendor.
- Investigate the process which has moved the file to the system folder.
Executable moved to Windows system folder by remote causality and a rare actor
Synopsis
Description
An attacker may be trying to avoid detection by moving an executable to a Windows system folder.
Attacker's Goals
- An attacker may be trying to avoid detection by moving an executable to a Windows system folder.
Investigative actions
- Check if the file is known in organization or malicious.
- Check if the digital signature of the file is valid and belongs to a known good software vendor.
- Investigate the process which has moved the file to the system folder.
Rare executable moved to Windows system folder by rare actor
Synopsis
Description
An attacker may be trying to avoid detection by moving an executable to a Windows system folder.
Attacker's Goals
- An attacker may be trying to avoid detection by moving an executable to a Windows system folder.
Investigative actions
- Check if the file is known in organization or malicious.
- Check if the digital signature of the file is valid and belongs to a known good software vendor.
- Investigate the process which has moved the file to the system folder.
Executable moved to Windows system folder by rare and unsigned actor
Synopsis
Description
An attacker may be trying to avoid detection by moving an executable to a Windows system folder.
Attacker's Goals
- An attacker may be trying to avoid detection by moving an executable to a Windows system folder.
Investigative actions
- Check if the file is known in organization or malicious.
- Check if the digital signature of the file is valid and belongs to a known good software vendor.
- Investigate the process which has moved the file to the system folder.