Windows Fonts Container Prefix Detection

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•0•0•2

This rule detects the creation of files in the Windows Fonts directory that have specific prefixes (X1, KX1, or KW1) followed by at least three alphanumeric characters, underscores, hyphens, or periods. This pattern is indicative of potential malicious activity, such as the deployment of container files or extensionless executables by malware like SprySocks, which may attempt to hide within system directories.