Suspicious Sysprep on AppData Folder (via process_creation)

title: Suspicious Sysprep on AppData Folder (via process_creation)
id: e646a2de-6bd3-53ff-bfee-01a93878ab41
status: stable
description: This rule detects anomalous sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec)
references:
    - https://attack.mitre.org/techniques/T1059/
    - https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets
    - https://app.any.run/tasks/61a296bb-81ad-4fee-955f-3b399f4aaf4b
author: Huntrule Team
date: 2026-02-25
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\sysprep.exe'
        CommandLine|contains: '\AppData\'
    condition: selection
falsepositives:
    - Unknown
level: medium