Writing Of Malicious Files To The Fonts Folder
This rule monitors for attempts to write potentially malicious files into the C:\Windows\Fonts\ directory using command-line utilities. This folder is often targeted by adversaries because it typically does not require administrative privileges for writing and execution, making it a suitable location for defense evasion and persistence. The rule specifically looks for common command-line tools (like 'echo', 'copy', 'type', 'file createnew', 'cacls') combined with the target path 'C:\Windows\Fonts\' and various executable or script file extensions.
Sigma
