Suspicious Copy From or To System Directory

SigmaHQ Detections@sigmaHQ

•updated Oct 9, 2025•0•15

Detects suspicious copy operations where a program is copied from a system directory (System32, SysWOW64, WinSxS) to another location on disk. This technique is often used by adversaries to move Living Off The Land Binaries (LOLBINs) like 'certutil' or 'desktopimgdownldr' to a different directory or rename them to bypass detections based on their original location or name.