File system activity
Adversaries lean on living-off-the-land techniques: modifying legitimate files, creating hidden payloads, abusing trusted utilities. A seemingly benign file like C:\ProgramData\1.dat followed by registry modifications under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fits the persistence-staging pattern exactly. Tying that to a parent process and outbound connection completes the picture.
The four lifecycle events
Creation
New executables, DLLs, or configuration files in non-standard locations. %APPDATA%, %LOCALAPPDATA%, %PROGRAMDATA%, %TEMP%. PowerShell creating DLLs in user directories. regsvr32.exe writing unexpected files.
Modification
Unexpected changes to system binaries, DLLs, or configuration files. Monitor C:\Windows\System32 for tampering. Watch trusted application directories for sideloading.
Deletion
Sudden removal of logs, binaries, or staging files often signals cleanup. Watch for log clearing tied to other suspicious activity.
Access patterns
Large-scale sequential reads of sensitive datasets (customer databases, financial records, intellectual property) point to data staging.
Suspicious patterns by category
🔁 Persistence mechanisms
- Registry autorun keys under
HKLM\Software\Microsoft\Windows\CurrentVersion\Runor the user-hive equivalent - Scheduled tasks with obfuscated commands or unusual triggers
- DLL Search Order Hijacking A persistence and privilege-escalation technique that places a malicious DLL where an application looks for libraries before the legitimate location, so a trusted, signed binary loads attacker code. Detected by watching for DLLs loaded from application or user-writable directories instead of their expected system paths. via malicious DLLs in application directories
💣 Payload deployment
- Executables in sensitive system directories (
C:\Windows\Tasks,C:\Windows\System32) - Files with double extensions (
invoice.pdf.exe) - DLLs created in temporary or user folders
🔒 Ransomware activity
- Bulk renaming of files with extensions like
.lockedor.encrypted - Rapid creation of ransom notes across many directories
📦 Exfiltration staging
- Large compressed archives (
.zip,.rar,.7z) containing sensitive data appearing shortly before outbound transfers
File metadata that matters
Parsing Breaking a raw alert, log line, or command string into its component fields so each can be examined on its own: the user, the host, the action, the time. In triage, parsing the alert is the first move; the details that decide a verdict live in the fields, not in the alert name. has to do more than catch file events. The Metadata Data about data: file timestamps, owner, size, hash; an email's headers; a process's parent, command line, and signing certificate. In triage, metadata is often more diagnostic than the content itself. on each file is where the signal often lives.
Fileless and LOLBin patterns
The hardest patterns to catch leave little or nothing on disk:
Memory-only execution
PowerShell loading code via System.Reflection.Assembly.Load() directly from memory.
WMI persistence
Scripts stored in the WMI repository or registry, executing via event subscriptions.
COM hijacking
Modifying HKCR to hijack legitimate COM objects.
LOLBins
certutil.exe decoding Base64 payloads. mshta.exe, wmic.exe, rundll32.exe for stealth execution.
File system activity frequently precedes exfiltration. Compressed archives created in %TEMP% shortly before outbound connections to low-reputation domains is a near-canonical pattern.
Key Takeaway
File system parsing gives you the longest tail of intrusion evidence. Combined with process and network telemetry, it is the layer that turns “something happened” into “here is exactly what happened, in order, with timestamps.”
Next up
Cloud and identity logs
Parse the control plane: CloudTrail anatomy, role chains, the IMDS pattern, and IdP sign-in logs.
Read cloud & identity