Core Windows system binary name running from outside System32

Siemphony@siemphonymediumT1036.005unverified

AN0983 asks for binaries "executed from trusted directories or using trusted names where the metadata, hash, or parent process does not align", and the one half of that a single process-creation event can settle by itself is location: a process carrying the file name of a core Windows system component while running from a path that is not System32, SysWOW64 or the servicing store. The name list is deliberately restricted to images that live in System32 in every supported Windows build, so a hit means the name was borrowed rather than that the process moved — explorer.exe is left out for exactly that reason, since it legitimately lives in C:\Windows and allowing that directory would also allow C:\Windows\Temp. The path filter is MITRE's `trusted_directory_list` knob, populated here with those three directories and written as `contains` rather than an absolute prefix so a system volume other than C: is still covered; the cost is that a planted C:\Temp\Windows\System32 directory would satisfy it. A bare `contains` on those directories would also excuse everything *below* them, including the handful of subdirectories under System32 and SysWOW64 that ordinary users can write to — spool\drivers\color is the one malware actually uses — so a second selection, added here rather than taken from the brief, puts those back in scope; nothing shipped by Windows runs any of these fifteen images from them. Metadata and hash comparison are not attempted: a hash needs a per-file baseline this corpus has no source for, and the metadata-mismatch case is a different observable, authored as its own rule under T1036.003. The brief maps Security 4688 onto Sigma's `process_creation` category, which is Sysmon-shaped, and this rule is written in that vocabulary (`Image`); on a 4688 feed the same value is `NewProcessName`, so that feed needs a field mapping before the rule matches at all, and 4688 itself only exists once *Audit Process Creation* is enabled — it is off in a default install and in the MS and CIS baselines, and zero rows would read as quiet when it means blind. The analytic's Sysmon EventID 11 leg is not attempted, nor are the Linux (AN0984) or macOS (AN0985) arms. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0347, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\svchost.exe" or FolderPath endswith "\\lsass.exe" or FolderPath endswith "\\services.exe" or FolderPath endswith "\\csrss.exe" or FolderPath endswith "\\smss.exe" or FolderPath endswith "\\wininit.exe" or FolderPath endswith "\\winlogon.exe" or FolderPath endswith "\\spoolsv.exe" or FolderPath endswith "\\dllhost.exe" or FolderPath endswith "\\conhost.exe" or FolderPath endswith "\\taskhostw.exe" or FolderPath endswith "\\dwm.exe" or FolderPath endswith "\\sihost.exe" or FolderPath endswith "\\ctfmon.exe" or FolderPath endswith "\\rundll32.exe") and ((FolderPath contains "\\System32\\spool\\drivers\\color\\" or FolderPath contains "\\System32\\spool\\PRINTERS\\" or FolderPath contains "\\System32\\spool\\SERVERS\\" or FolderPath contains "\\System32\\Tasks_Migrated\\" or FolderPath contains "\\System32\\com\\dmp\\" or FolderPath contains "\\System32\\FxsTmp\\" or FolderPath contains "\\System32\\Microsoft\\Crypto\\RSA\\MachineKeys\\" or FolderPath contains "\\SysWOW64\\com\\dmp\\" or FolderPath contains "\\SysWOW64\\FxsTmp\\") or not ((FolderPath contains "\\Windows\\System32\\" or FolderPath contains "\\Windows\\SysWOW64\\" or FolderPath contains "\\Windows\\WinSxS\\"))))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\svchost.exe" OR Image="*\\lsass.exe" OR Image="*\\services.exe" OR Image="*\\csrss.exe" OR Image="*\\smss.exe" OR Image="*\\wininit.exe" OR Image="*\\winlogon.exe" OR Image="*\\spoolsv.exe" OR Image="*\\dllhost.exe" OR Image="*\\conhost.exe" OR Image="*\\taskhostw.exe" OR Image="*\\dwm.exe" OR Image="*\\sihost.exe" OR Image="*\\ctfmon.exe" OR Image="*\\rundll32.exe") AND ((Image="*\\System32\\spool\\drivers\\color\\*" OR Image="*\\System32\\spool\\PRINTERS\\*" OR Image="*\\System32\\spool\\SERVERS\\*" OR Image="*\\System32\\Tasks_Migrated\\*" OR Image="*\\System32\\com\\dmp\\*" OR Image="*\\System32\\FxsTmp\\*" OR Image="*\\System32\\Microsoft\\Crypto\\RSA\\MachineKeys\\*" OR Image="*\\SysWOW64\\com\\dmp\\*" OR Image="*\\SysWOW64\\FxsTmp\\*") OR NOT ((Image="*\\Windows\\System32\\*" OR Image="*\\Windows\\SysWOW64\\*" OR Image="*\\Windows\\WinSxS\\*"))))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\svchost.exe" OR TO_LOWER(process.executable) LIKE "*\\\\lsass.exe" OR TO_LOWER(process.executable) LIKE "*\\\\services.exe" OR TO_LOWER(process.executable) LIKE "*\\\\csrss.exe" OR TO_LOWER(process.executable) LIKE "*\\\\smss.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wininit.exe" OR TO_LOWER(process.executable) LIKE "*\\\\winlogon.exe" OR TO_LOWER(process.executable) LIKE "*\\\\spoolsv.exe" OR TO_LOWER(process.executable) LIKE "*\\\\dllhost.exe" OR TO_LOWER(process.executable) LIKE "*\\\\conhost.exe" OR TO_LOWER(process.executable) LIKE "*\\\\taskhostw.exe" OR TO_LOWER(process.executable) LIKE "*\\\\dwm.exe" OR TO_LOWER(process.executable) LIKE "*\\\\sihost.exe" OR TO_LOWER(process.executable) LIKE "*\\\\ctfmon.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe") AND ((TO_LOWER(process.executable) LIKE "*\\\\system32\\\\spool\\\\drivers\\\\color\\\\*" OR TO_LOWER(process.executable) LIKE "*\\\\system32\\\\spool\\\\printers\\\\*" OR TO_LOWER(process.executable) LIKE "*\\\\system32\\\\spool\\\\servers\\\\*" OR TO_LOWER(process.executable) LIKE "*\\\\system32\\\\tasks_migrated\\\\*" OR TO_LOWER(process.executable) LIKE "*\\\\system32\\\\com\\\\dmp\\\\*" OR TO_LOWER(process.executable) LIKE "*\\\\system32\\\\fxstmp\\\\*" OR TO_LOWER(process.executable) LIKE "*\\\\system32\\\\microsoft\\\\crypto\\\\rsa\\\\machinekeys\\\\*" OR TO_LOWER(process.executable) LIKE "*\\\\syswow64\\\\com\\\\dmp\\\\*" OR TO_LOWER(process.executable) LIKE "*\\\\syswow64\\\\fxstmp\\\\*") OR NOT ((TO_LOWER(process.executable) LIKE "*\\\\windows\\\\system32\\\\*" OR TO_LOWER(process.executable) LIKE "*\\\\windows\\\\syswow64\\\\*" OR TO_LOWER(process.executable) LIKE "*\\\\windows\\\\winsxs\\\\*"))))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\svchost\.exe$|\\lsass\.exe$|\\services\.exe$|\\csrss\.exe$|\\smss\.exe$|\\wininit\.exe$|\\winlogon\.exe$|\\spoolsv\.exe$|\\dllhost\.exe$|\\conhost\.exe$|\\taskhostw\.exe$|\\dwm\.exe$|\\sihost\.exe$|\\ctfmon\.exe$|\\rundll32\.exe$)</field>    <field name="Image" type="pcre2">(?i)(\\System32\\spool\\drivers\\color\\|\\System32\\spool\\PRINTERS\\|\\System32\\spool\\SERVERS\\|\\System32\\Tasks_Migrated\\|\\System32\\com\\dmp\\|\\System32\\FxsTmp\\|\\System32\\Microsoft\\Crypto\\RSA\\MachineKeys\\|\\SysWOW64\\com\\dmp\\|\\SysWOW64\\FxsTmp\\)</field>    <description>Core Windows system binary name running from outside System32 (1/2)</description>    <mitre>      <id>T1036.005</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\svchost\.exe$|\\lsass\.exe$|\\services\.exe$|\\csrss\.exe$|\\smss\.exe$|\\wininit\.exe$|\\winlogon\.exe$|\\spoolsv\.exe$|\\dllhost\.exe$|\\conhost\.exe$|\\taskhostw\.exe$|\\dwm\.exe$|\\sihost\.exe$|\\ctfmon\.exe$|\\rundll32\.exe$)</field>    <field name="Image" negate="yes" type="pcre2">(?i)(\\Windows\\System32\\|\\Windows\\SysWOW64\\|\\Windows\\WinSxS\\)</field>    <description>Core Windows system binary name running from outside System32 (2/2)</description>    <mitre>      <id>T1036.005</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: masquerading
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 427510ee-93e8-498b-b947-dd1dc8c81763

ATT&CKT1036.005

T1036.005Match Legitimate Resource Name or Location

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonmasquerading

masqueradingAI draft — unreviewed

01 · What this rule detects

A process carrying the file name of a core Windows system component while running from somewhere that component never lives. AN0983 asks for binaries "executed from trusted directories or using trusted names where the metadata, hash, or parent process does not align". A single process-creation event can settle exactly one part of that — location — so this rule answers "trusted name, untrusted path", not the metadata or hash half.

02 · Telemetry you need

Process creation for product: windows. The brief maps Security 4688 onto Sigma's process_creation category, but that category is Sysmon-shaped and the rule is written in the Sysmon vocabulary: it selects on Image. On a 4688 feed the same value is NewProcessName, so that feed needs a field mapping before the rule matches anything at all. 4688 also only exists once Audit Process Creation is enabled — off in a default install and in the MS and CIS baselines — and zero rows there reads as quiet when it means blind.

03 · How the logic works

selection_trusted_name is fifteen Image|endswith values: svchost, lsass, services, csrss, smss, wininit, winlogon, spoolsv, dllhost, conhost, taskhostw, dwm, sihost, ctfmon, rundll32. Every one lives in System32 on every supported build, so a hit means the name was borrowed rather than that the process moved. explorer.exe is deliberately absent: it lives in C:\Windows, and allowing that directory would also allow C:\Windows\Temp. filter_system_paths is MITRE's trusted_directory_list knob, populated here with System32, SysWOW64 and WinSxS, written as contains rather than an absolute prefix so a non-C: system volume still works. The cost is that a planted C:\Temp\Windows\System32 satisfies it. contains also excuses everything below those directories, including the subdirectories an unprivileged user can write to. That is why selection_writable_subdir exists — nine paths added by the pipeline, not taken from the brief, led by \System32\spool\drivers\color\, the one commodity malware actually uses. The condition, selection_trusted_name and (selection_writable_subdir or not filter_system_paths), puts them back in scope. Nothing Windows ships runs these fifteen images from there.

04 · Common false positives

Application virtualisation is the dominant source: App-V, MSIX, AppX, Citrix App Layering and FSLogix run the genuine binary from a package store, so rundll32.exe or dllhost.exe reports a path under ProgramData\App-V, WindowsApps or a layer mount. Feature updates produce a burst per host as Windows Setup executes staged copies from $WINDOWS.~BT\Sources and Windows\Temp. Installers dropping a private rundll32.exe do the same. Note that recovery environments do not match — WinRE runs from X:\Windows\System32\, which the filter excuses.

05 · Detection maturity

tier_1: Lowest tier, and it stays there until run against real data. Be clear about scope: this covers half of AN0983. The trusted-directory-plus-misaligned- metadata half needs a per-file hash baseline or a signature comparison this corpus has no source for, so do not read the rule as full analytic coverage. The Sysmon EventID 11 leg and the Linux (AN0984) and macOS (AN0985) arms are unauthored.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Almost all the volume comes from three of the fifteen names. Split the rule: rundll32, dllhost and conhost at low with the virtualisation and servicing false positives attached, and the other twelve at high — lsass.exe outside System32 is close to a certain true positive and should not share a bucket with App-V noise. Until you split, low is the honest level, because the stated top false positive is described as the highest-volume match by a wide margin. Allowlist by full path, never by name.

Declared by the author

Application virtualisation and layering. App-V, MSIX and AppX packages, Citrix App Layering and FSLogix all run the genuine binary from a package store, so rundll32.exe or dllhost.exe reports an Image under C:\ProgramData\App-V, C:\Program Files\WindowsApps or a layer mount point instead of System32. On estates using any of these it is the highest-volume match here by a wide margin, which is why the level is medium rather than high.
Feature updates and servicing. Windows Setup stages and executes copies of system binaries from C:\$WINDOWS.~BT\Sources, C:\Windows\Temp and installer working directories during an in-place upgrade, producing a burst of matches on every host that upgrades.
Installers and updaters that drop a private copy of rundll32.exe or dllhost.exe into their own temporary or program directory to run a control-panel applet or a COM registration from there, rather than calling the system copy.
Backup, imaging and forensic tooling that mounts another Windows installation or a captured image and runs binaries out of a scratch directory whose path does not contain \Windows\System32\, plus recovery agents operating from a WinRE or vendor rescue partition.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1036.005, evaluated against their process_creation events.

Share this rule

/u/siemphony/427510ee-93e8-498b-b947-dd1dc8c81763

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Core Windows system binary name running from outside System32

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it