Query: write Sigma for Detects a potentially suspicious powershell script executions from temporary folder
Matching passage: Sigma rule: Detects a potentially suspicious powershell script executions from temporary folder. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Powershell Script Execution From Temp Folder id: a6a39bdb-935c-4f0a-ab77-35f4bbf44d33 status: test description: Detects a potentially suspicious powershell script executions from temporary folder references: - https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/ author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton date: 2021-07-14 modified: 2026-02-17 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - \Windows\Temp - \Temporary Internet - \AppData\Local\Temp - \AppData\Roaming\Temp - '%TEMP%' - '%TMP%' - '%LocalAppData%\Temp' filter_optional_vscode: CommandLine|contains: -WindowStyle hidden -Verb runAs filter_optional_amazon_ec2: CommandLine|contains: \Windows\system32\config\systemprofile\AppData\Local\Temp\Amazon\EC2-Windows\ filter_optional_generic: CommandLine|contains: - ' >' - Out-File - ConvertTo-Json filter_optional_chocolatey_installer: ParentImage: - C:\Windows\System32\Msiexec.exe - C:\Windows\SysWOW64\Msiexec.exe Image|endswith: \powershell.exe CommandLine|contains|all: - -NoProfile -ExecutionPolicy Bypass -Command - AppData\Local\Temp\ - Install-Chocolatey.ps1 condition: selection and not 1 of filter_optional_* falsepositives: - Administrative scripts level: medium
Near-miss passage: Sigma rule: Detects suspicious PowerShell invocation with a parameter substring. Logsource: windows / process_creation. Rule: title: Suspicious PowerShell Parameter Substring id: 36210e0d-5b19-485d-a087-c096088885f0 status: test description: Detects suspicious PowerShell invocation with a parameter substring references: - http://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix) date: 2019-01-16 modified: 2022-07-14 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - ' -windowstyle h ' - ' -windowstyl h' - ' -windowsty h' - ' -windowst h' - ' -windows h' - ' -windo h' - ' -wind h' - ' -win h' - ' -wi h' - ' -win h ' - ' -win hi ' - ' -win hid ' - ' -win hidd ' - ' -win hidde ' - ' -NoPr ' - ' -NoPro ' - ' -NoProf ' - ' -NoProfi ' - ' -NoProfil ' - ' -nonin ' - ' -nonint ' - ' -noninte ' - ' -noninter ' - ' -nonintera ' - ' -noninterac ' - ' -noninteract ' - ' -noninteracti ' - ' -noninteractiv ' - ' -ec ' - ' -encodedComman ' - ' -encodedComma ' - ' -encodedComm ' - ' -encodedCom ' - ' -encodedCo ' - ' -encodedC ' - ' -encoded ' - ' -encode ' - ' -encod ' - ' -enco ' - ' -en ' - ' -executionpolic ' - ' -executionpoli ' - ' -executionpol ' - ' -executionpo ' - ' -executionp ' - ' -execution bypass' - ' -executio bypass' - ' -executi bypass' - ' -execut bypass' - ' -execu bypass' - ' -exec bypass' - ' -exe bypass' - ' -ex bypass' - ' -ep bypass' - ' /windowstyle h ' - ' /windowstyl h' - ' /windowsty h' - ' /windowst h' - ' /windows h' - ' /windo h' - ' /wind h' - ' /win h' - ' /wi h' - ' /win h ' - ' /win hi ' - ' /win hid ' - ' /win hidd ' - ' /win hidde ' - ' /NoPr ' - ' /NoPro ' - ' /NoProf ' - ' /NoProfi ' - ' /NoProfil ' - ' /nonin ' - ' /nonint ' - ' /noninte ' - ' /noninter ' - ' /nonintera ' - ' /noninterac ' - ' /noninteract ' - ' /noninteracti ' - ' /noninteractiv ' - ' /ec ' - ' /encodedComman ' - ' /encodedComma ' - ' /encodedComm ' - ' /encodedCom ' - ' /encodedCo ' - ' /encodedC ' - ' /encoded ' - ' /encode ' - ' /encod ' - ' /enco ' - ' /en ' - ' /executionpolic ' - ' /executionpoli ' - ' /executionpol ' - ' /executionpo ' - ' /executionp ' - ' /execution bypass' - ' /executio bypass' - ' /executi bypass' - ' /execut bypass' - ' /execu bypass' - ' /exec bypass' - ' /exe bypass' - ' /ex bypass' - ' /ep bypass' condition: selection falsepositives: - Unknown level: high