Suspicious Script Execution From Temp Folder

Severity: high
Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton
Source: upstream

Detects a suspicious script executions from temporary folder

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059` Command and Scripting Interpreter

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation
Security-Auditing	4688	A new process has been created.

Stages and Predicates

Stage 1: `selection`

or:
CommandLine|contains: '%LocalAppData%\Temp'
CommandLine|contains: '%TEMP%'
CommandLine|contains: '%TMP%'
CommandLine|contains: '\AppData\Local\Temp'
CommandLine|contains: '\AppData\Roaming\Temp'
CommandLine|contains: '\Temporary Internet'
CommandLine|contains: '\Windows\Temp'
or:
Image|endswith: '\cscript.exe'
Image|endswith: '\mshta.exe'
Image|endswith: '\powershell.exe'
Image|endswith: '\pwsh.exe'
Image|endswith: '\wscript.exe'

Stage 2: `not filter`

or:
CommandLine|contains: ' >'
CommandLine|contains: '-WindowStyle hidden -Verb runAs'
CommandLine|contains: ConvertTo-Json
CommandLine|contains: Out-File
CommandLine|contains: '\Windows\system32\config\systemprofile\AppData\Local\Temp\Amazon\EC2-Windows\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`>` corpus 2 (sigma 2) `%LocalAppData%\Temp` `%TEMP%` corpus 2 (sigma 2) `%TMP%` corpus 2 (sigma 2) `-WindowStyle hidden -Verb runAs` `ConvertTo-Json` `Out-File` corpus 3 (sigma 3) `\AppData\Local\Temp` corpus 8 (sigma 8) `\AppData\Roaming\Temp` corpus 2 (sigma 2) `\Temporary Internet` corpus 6 (sigma 6) `\Windows\Temp` corpus 2 (sigma 2) `\Windows\system32\config\systemprofile\AppData\Local\Temp\Amazon\EC2-Windows\`
`Image`	ends_with	`\cscript.exe` corpus 64 (sigma 64) `\mshta.exe` corpus 57 (sigma 57) `\powershell.exe` corpus 143 (sigma 143) `\pwsh.exe` corpus 140 (sigma 140) `\wscript.exe` corpus 64 (sigma 64)