Update: Suspicious Copy From or To System Directory

[swachchhanda000]

Summary of the Pull Request

Skeleton Spider abused the xcopy utility to copy ie4unit.exe from system32 to %AppData%\Microsoft\ to execute malicious inf file.

Changelog

fix: Suspicious Copy From or To System Directory - add FP filter
update: LOL-Binary Copied From System Directory - add new LOLBIN

Example Log Event

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
  <Provider Name="Microsoft-Windows-Sysmon" Guid="{5770385f-c22a-43e0-bf4c-06f5698ffbd9}" /> 
  <EventID>1</EventID> 
  <Version>5</Version> 
  <Level>4</Level> 
  <Task>1</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8000000000000000</Keywords> 
  <TimeCreated SystemTime="2025-06-16T07:33:35.6879240Z" /> 
  <EventRecordID>15530</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="3208" ThreadID="1724" /> 
  <Channel>Microsoft-Windows-Sysmon/Operational</Channel> 
  <Computer>swachchhanda</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
<EventData>
  <Data Name="RuleName">-</Data> 
  <Data Name="UtcTime">2025-06-16 07:33:35.678</Data> 
  <Data Name="ProcessGuid">{0197231e-c8cf-684f-bb0c-000000000800}</Data> 
  <Data Name="ProcessId">4036</Data> 
  <Data Name="Image">C:\Windows\System32\Robocopy.exe</Data> 
  <Data Name="FileVersion">10.0.26100.2454 (WinBuild.160101.0800)</Data> 
  <Data Name="Description">Microsoft Robocopy</Data> 
  <Data Name="Product">Microsoft® Windows® Operating System</Data> 
  <Data Name="Company">Microsoft Corporation</Data> 
  <Data Name="OriginalFileName">robocopy.exe</Data> 
  <Data Name="CommandLine">C:\Windows\System32\Robocopy.exe</Data> 
  <Data Name="CurrentDirectory">C:\Users\xodih\</Data> 
  <Data Name="User">swachchhanda\xodih</Data> 
  <Data Name="LogonGuid">{0197231e-ab9f-67aa-fb17-030000000000}</Data> 
  <Data Name="LogonId">0x317fb</Data> 
  <Data Name="TerminalSessionId">1</Data> 
  <Data Name="IntegrityLevel">Medium</Data> 
  <Data Name="Hashes">MD5=2EA5C0894599E1D4676E16FE90B94E1B,SHA256=941C6E630013EC14889ABAB2F1537E8BABD2FAF3D257A27291A2FEC9F342075F,IMPHASH=43593296F7AE635E6B02BE8BA81A3AFD</Data> 
  <Data Name="ParentProcessGuid">{0197231e-c44f-684f-f90b-000000000800}</Data> 
  <Data Name="ParentProcessId">956</Data> 
  <Data Name="ParentImage">C:\Windows\System32\cmd.exe</Data> 
  <Data Name="ParentCommandLine">"C:\WINDOWS\system32\cmd.exe"</Data> 
  <Data Name="ParentUser">swachchhanda\xodih</Data> 
  </EventData>
  </Event>

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[swachchhanda000]

Suggested change

	- '\System32'
	- '\SysWOW64'
	- '\WinSxS'
	condition: 1 of selection_* and target
	filter_main_cmd:
	CommandLine|endswith:
	- 'C:\Windows\System32\xcopy.exe'
	- 'C:\Windows\SysWOW64\xcopy.exe'
	- 'C:\Windows\System32\robocopy.exe'
	- 'C:\Windows\SysWOW64\robocopy.exe'
	condition: 1 of selection_* and target and not 1 of filter_main_*
	falsepositives:
	- ' C:\Windows\System32'
	- ' C:\Windows\SysWOW64'
	- ' C:\Windows\WinSxS'
	- ' "C:\Windows\System32'
	- ' "C:\Windows\SysWOW64'
	- ' "C:\Windows\WinSxS'
	- " 'C:\Windows\System32"
	- " 'C:\Windows\SysWOW64"
	- " 'C:\Windows\WinSxS"
	condition: 1 of selection_* and target
	falsepositives:

Even though I have added the filter, it would still have fp on legitimate cases like C:\Windows\System32\xcopy.exe C:\Test C:\Test\A.
So, I propose we add preceding space with the full paths. This way, the filter more accurately matches only the intended directory references and avoids executables being run from those locations (e.g., cmd.exe, robocopy.exe, etc.).

[phantinuss]

I like this approach much better.

[swachchhanda000]

The line 53-36 caused parsing issue, thus I had to use regex as last resort

[phantinuss]

Suggested change

	CommandLine|re: (?i)\s[\s'"]?C:\\Windows\\((System32|SysWOW64|WinSxS))
	CommandLine|re|i: \s['"]?C:\\Windows\\(System32|SysWOW64|WinSxS)

• see https://github.com/SigmaHQ/sigma-specification/blob/main/appendix/sigma-modifiers-appendix.md#regular-expression
• I don't see why the beginning needs to match \s\s?
• remove redundant grouping

[phantinuss]

Suggested change

	modified: 2025-06-16
	modified: 2025-07-28

[phantinuss]

Suggested change

	date: 2025-06-16
	date: 2023-08-29
	modified: 2025-07-28