Suspicious Executable File Creation
This rule detects the creation of executable files with suspicious names or extensions. Specifically, it looks for files ending with '.exe' that are appended to common system directory names (e.g., ':\$Recycle.Bin.exe', ':\MSOCache.exe') or other executable extensions (e.g., '.bat.exe', '.sys.exe'). This pattern is often used in unquoted service path vulnerabilities or to masquerade malicious executables as legitimate system files.
Sigma
