Loading

File Staged in Root Folder of Recycle Bin

Identifies files written to the root of the Recycle Bin folder instead of subdirectories. Adversaries may place files in the root of the Recycle Bin in preparation for exfiltration or to evade defenses.

Rule type: eql
Rule indices:

  • logs-endpoint.events.file-*
  • logs-windows.sysmon_operational-*
  • endgame-*
  • winlogbeat-*

Rule Severity: low
Risk Score: 21
Runs every: 60m
Searches indices from: now-119m
Maximum alerts per execution: ?
References:

Tags:

  • Domain: Endpoint
  • OS: Windows
  • Use Case: Threat Detection
  • Tactic: Collection
  • Data Source: Elastic Defend
  • Rule Type: BBR
  • Data Source: Elastic Endgame
  • Data Source: Sysmon

Version: ?
Rule authors:

  • Elastic

Rule license: Elastic License v2

file where host.os.type == "windows" and event.type == "creation" and
  file.path : "?:\\$RECYCLE.BIN\\*" and
  not file.path : "?:\\$RECYCLE.BIN\\*\\*" and
  not file.name : "desktop.ini"

Framework: MITRE ATT&CK