Executable file dropped in folder commonly used by malware.

Description

No license declared

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 92203 Executable file created by powershell · win.eventdata.image = (?i)powershell\.exe, win.eventdata.targetFilename = (?i)\.(exe|com|dll|vbs|js|bat|cmd|pif|wsh|ps1|lnk|msi|vbe) anchor level 6
   field win.eventdata.image="(?i)powershell\.exe" AND field win.eventdata.targetFilename="(?i)\.(exe|com|dll|vbs|js|bat|cmd|pif|wsh|ps1|lnk|msi|vbe)"
2. 92204 Powershell process created executable file in AppData temp folder anchor level 9
   field win.eventdata.targetFilename="(?i)AppData\\\\(Roaming|local)"
3. 900030 Executable file dropped in folder commonly used by malware. exclusion level 8 this rule
   Matches no fields of its own.

Rule dependencies

Depends on

• composes · Wazuh if_sid 92204
  • Powershell process created executable file in AppData temp folder
• composes · Wazuh if_sid 92207
  • Executable file dropped in Users\Public folder
• composes · Wazuh if_sid 92213
  • Executable file dropped in folder commonly used by malware