File Masquerading as Legitimate Binaries Dropped in Suspicious Location

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects instances of Legitimate binary named such as svchost.exe, rundll32.exe being dropped in suspicious location, which is highly unusual. Legitimate software typically does not create or modify svchost.exe during normal operations. Such activity could indicate malicious behavior, such as malware disguising itself as a system process or persistence mechanisms using renamed malicious executables.

2025-02-26 00:00:00

None

5064462d-e1b5-4d4b-be14-d88ae49b8622

attack.defense-evasion attack.t1036.005

Nextron Sigma feed only (private)