Detection: Batch File Write to System32

Updated Date: 2026-07-02 ID: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3 Author: Steven Dick, Michael Haag, Rico Valdez, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

The following analytic detects the creation of a batch file (.bat) within the Windows system directory tree, specifically in the System32 or SysWOW64 folders. It leverages data from the Endpoint datamodel, focusing on process and filesystem events to identify this behavior. This activity is significant because writing batch files to system directories can be indicative of malicious intent, such as persistence mechanisms or system manipulation. If confirmed malicious, this could allow an attacker to execute arbitrary commands with elevated privileges, potentially compromising the entire system.

Search

 1
 2| tstats `security_content_summariesonly`
 3  count min(_time) as firstTime
 4        max(_time) as lastTime
 5
 6FROM datamodel=Endpoint.Filesystem where
 7
 8Filesystem.action IN (
 9    "created",
10    "modified"
11)
12Filesystem.file_path IN (
13    "*:\\Windows\\System32\\*",
14    "*:\\Windows\\SysWOW64\\*"
15)
16Filesystem.file_name IN (
17    "*.bat",
18    "*.cmd"
19)
20
21by Filesystem.action Filesystem.dest Filesystem.file_access_time
22   Filesystem.file_create_time Filesystem.file_hash
23   Filesystem.file_modify_time Filesystem.file_name
24   Filesystem.file_path Filesystem.file_acl
25   Filesystem.file_size Filesystem.process_guid
26   Filesystem.process_id Filesystem.user Filesystem.vendor_product
27
28
29| `drop_dm_object_name(Filesystem)`
30
31| `security_content_ctime(firstTime)`
32
33| `security_content_ctime(lastTime)`
34
35| `batch_file_write_to_system32_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 11	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
batch_file_write_to_system32_filter	`search *`

batch_file_write_to_system32_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1204.002	Malicious File	Execution

Installation

DE.AE

CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	Yes

Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.

Implementation

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. You must also be ingesting the Endpoint.Filesystem data source.

Known False Positives

Some batch files are written to the system32 directory tree for legitimate purposes, such as system maintenance or configuration. Investigate the batch file to determine if it is legitimate and modify the search to add exclusions, as necessary.

Associated Analytic Story

Intermediate Findings

Message	Entity Field	Entity Type	Risk Score
A new batch file [$file_name$] was written to [$file_path$] on endpoint $dest$ by user $user$.	dest	system	20

Threat Objects

Field	Type
file_path	file_path

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`
Integration	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 15