Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Suspicious writes to windows Recycle Bin

The following analytic detects when a process other than explorer.exe writes to the Windows Recycle Bin. It leverages the Endpoint.Filesystem and Endpoint.Processes data models in Splunk to identify any process writing to the "*$Recycle.Bin*" file path, excluding explorer.exe. This activity is significant because it may indicate an attacker attempting to hide their actions, potentially leading to data theft, ransomware, or other malicious outcomes. If confirmed malicious, this behavior could allow an attacker to persist in the environment and evade detection by security tools.

ATT&CK coverage

Outside the enterprise matrix

T1036

Detection requirements

Log source category: sysmon_eventid_1_and_sysmon_eventid_11

What the source says

What fires this without an attack behind it

Because the Recycle Bin is a hidden folder in modern versions of Windows, it would be unusual for a process other than explorer.exe to write to it. Incidents should be investigated as appropriate.

Tagged by the source as

Collection and StagingPlugXWindowsendpointSplunk CloudSplunk EnterpriseSplunk Enterprise Securityendpoint

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.