Title:Execution via WorkFolders.exe Status:test Description:Detects using WorkFolders.exe to execute an arbitrary control.exe References: -https://twitter.com/elliotkillick/status/1449812843772227588 Author: Maxime Thiebaut (@0xThiebaut) Date: 2021-10-21 modified:2022-12-25 Tags:
-'attack.stealth'
-'attack.t1218'
Logsource:
category: process_creation
product: windows
Detection: selection: Image|endswith:
'\control.exe' ParentImage|endswith:
'\WorkFolders.exe' filter: Image:
'C:\Windows\System32\control.exe' condition:selection and not filter Falsepositives:
-Legitimate usage of the uncommon Windows Work Folders feature. Level:high
