Process Creation Using Sysnative Folder

SigmaHQ Detections@sigmaHQ

•updated Oct 9, 2025•1•0•14

This rule detects the creation of processes where the command line or image path explicitly references the 'Sysnative' folder (e.g., 'C:\Windows\Sysnative\'). This behavior is often observed in malware, particularly Cobalt Strike, to bypass WoW64 file system redirection and execute 64-bit binaries from a 32-bit process. The rule includes filters to reduce false positives from legitimate applications like .NET's ngen.exe and XAMPP's use of cmd.exe within Sysnative.