Suspicious PowerShell Script Run in AppData (via process_creation)

title: Suspicious PowerShell Script Run in AppData (via process_creation)
id: bcbad0fe-864b-5804-a9b3-5f2917505f36
status: stable
description: This rule detects an anomalous command line execution that invokes PowerShell with reference to an AppData folder
references:
    - https://attack.mitre.org/techniques/T1059/001/
    - https://twitter.com/JohnLaTwC/status/1082851155481288706
    - https://app.any.run/tasks/f87f1c4e-47e2-4c46-9cf4-31454c06ce03
author: Huntrule Team
date: 2026-05-17
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection1:
        CommandLine|contains:
            - 'powershell.exe'
            - '\powershell'
            - '\pwsh'
            - 'pwsh.exe'
    selection2:
        CommandLine|contains|all:
            - '/c '
            - '\AppData\'
        CommandLine|contains:
            - 'Local\'
            - 'Roaming\'
    condition: all of selection*
falsepositives:
    - Unknown
level: medium