Suspicious File Creation Inside Masqueraded System32 Path

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects suspicious file creation event in the System32 directory where an adversary attempts to masquerade the path using a space between "Windows" and "\System32". This technique may be used for to bypass UAC through hijacking dll load flow abuse, logging mechanisms, or detection rules that rely on exact path matching. Attackers may leverage this to deploy malware, persistence mechanisms, or execute payloads stealthily.

2025-02-27 00:00:00

None

32c65dfe-c1f4-4184-8f0c-34146cc603f6

attack.defense-evasion attack.t1036.005

Nextron Sigma feed only (private)