System File Execution Location Anomaly

{
  "selection": {
    "Image
| endswith": [
      "\\atbroker.exe",
      "\\audiodg.exe",
      "\\bcdedit.exe",
      "\\bitsadmin.exe",
      "\\certreq.exe",
      "\\certutil.exe",
      "\\cmstp.exe",
      "\\conhost.exe",
      "\\consent.exe",
      "\\cscript.exe",
      "\\csrss.exe",
      "\\dashost.exe",
      "\\defrag.exe",
      "\\dfrgui.exe",
      "\\dism.exe",
      "\\dllhost.exe",
      "\\dllhst3g.exe",
      "\\dwm.exe",
      "\\eventvwr.exe",
      "\\fsquirt.exe",
      "\\finger.exe",
      "\\logonui.exe",
      "\\LsaIso.exe",
      "\\lsass.exe",
      "\\lsm.exe",
      "\\msiexec.exe",
      "\\ntoskrnl.exe",
      "\\powershell_ise.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\runonce.exe",
      "\\RuntimeBroker.exe",
      "\\schtasks.exe",
      "\\services.exe",
      "\\sihost.exe",
      "\\smartscreen.exe",
      "\\smss.exe",
      "\\spoolsv.exe",
      "\\svchost.exe",
      "\\taskhost.exe",
      "\\taskhostw.exe",
      "\\Taskmgr.exe",
      "\\userinit.exe",
      "\\werfault.exe",
      "\\werfaultsecure.exe",
      "\\wininit.exe",
      "\\winlogon.exe",
      "\\winver.exe",
      "\\wlanext.exe",
      "\\wmic.exe",
      "\\wscript.exe",
      "\\wsl.exe",
      "\\wsmprovhost.exe"
    ]
  },
  "filter_main_generic": {
    "Image
| startswith": [
      "C:\\$WINDOWS.~BT\\",
      "C:\\$WinREAgent\\",
      "C:\\Windows\\SoftwareDistribution\\",
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SystemTemp\\",
      "C:\\Windows\\SysWOW64\\",
      "C:\\Windows\\uus\\",
      "C:\\Windows\\WinSxS\\"
    ]
  },
  "filter_optional_system32": {
    "Image
| contains": "\\SystemRoot\\System32\\"
  },
  "filter_main_powershell": {
    "Image
| contains": [
      "C:\\Program Files\\PowerShell\\7\\",
      "C:\\Program Files\\PowerShell\\7-preview\\",
      "C:\\Program Files\\WindowsApps\\Microsoft.PowerShellPreview",
      "\\AppData\\Local\\Microsoft\\WindowsApps\\Microsoft.PowerShellPreview"
    ],
    "Image
| endswith": "\\pwsh.exe"
  },
  "filter_main_wsl_programfiles": {
    "Image
| startswith": [
      "C:\\Program Files\\WindowsApps\\MicrosoftCorporationII.WindowsSubsystemForLinux",
      "C:\\Program Files\\WSL\\"
    ],
    "Image
| endswith": "\\wsl.exe"
  },
  "filter_main_wsl_appdata": {
    "Image
| startswith": "C:\\Users\\",
    "Image
| contains": "\\AppData\\Local\\Microsoft\\WindowsApps\\",
    "Image
| endswith": "\\wsl.exe"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

False Positives

• ⚠ Unknown