Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects a potentially suspicious powershell script executions from temporary folder. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Powershell Script Execution From Temp Folder id: a6a39bdb-935c-4f0a-ab77-35f4bbf44d33 status: test description: Detects a potentially suspicious powershell script executions from temporary folder references: - https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/ author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton date: 2021-07-14 modified: 2026-02-17 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - \Windows\Temp - \Temporary Internet - \AppData\Local\Temp - \AppData\Roaming\Temp - '%TEMP%' - '%TMP%' - '%LocalAppData%\Temp' filter_optional_vscode: CommandLine|contains: -WindowStyle hidden -Verb runAs filter_optional_amazon_ec2: CommandLine|contains: \Windows\system32\config\systemprofile\AppData\Local\Temp\Amazon\EC2-Windows\ filter_optional_generic: CommandLine|contains: - ' >' - Out-File - ConvertTo-Json filter_optional_chocolatey_installer: ParentImage: - C:\Windows\System32\Msiexec.exe - C:\Windows\SysWOW64\Msiexec.exe Image|endswith: \powershell.exe CommandLine|contains|all: - -NoProfile -ExecutionPolicy Bypass -Command - AppData\Local\Temp\ - Install-Chocolatey.ps1 condition: selection and not 1 of filter_optional_* falsepositives: - Administrative scripts level: medium
Near-miss passage: Sigma rule: Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to e. Logsource: windows / file_event. Rule: title: ADExplorer Writing Complete AD Snapshot Into .dat File id: 0a1255c5-d732-4b62-ac02-b5152d34fb83 related: - id: 9212f354-7775-4e28-9c9f-8f0a4544e664 type: similar status: experimental description: Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field. references: - https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer - https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24 - https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/ - https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/ - https://trustedsec.com/blog/adexplorer-on-engagements author: Arnim Rupp (Nextron Systems), Thomas Patzke date: 2025-07-09 tags: - attack.discovery - attack.t1087.002 - attack.t1069.002 - attack.t1482 logsource: category: file_event product: windows detection: selection: Image|endswith: - \ADExp.exe - \ADExplorer.exe - \ADExplorer64.exe - \ADExplorer64a.exe TargetFilename|endswith: .dat condition: selection falsepositives: - Legitimate use of ADExplorer by administrators creating .dat snapshots level: medium