Files With System Process Name In Unsuspected Locations

SigmaHQ Detections@sigmaHQ

•updated Oct 9, 2025•0•22

Detects the creation of executable files with names identical to legitimate Windows system processes in directories other than their standard system locations (e.g., System32, SysWOW64). This technique is often used by adversaries for defense evasion and masquerading to blend malicious executables with legitimate system files.