Windows Process Creation: Detect GUID-Like Folder Paths in Command Line

title: "Windows Process Creation: Detect GUID-Like Folder Paths in Command Line"
id: d69f74a9-768d-444a-9c46-5326fc85d90b
status: test
description: This rule flags Windows process creation events where the command line contains a GUID-like folder pattern ("{" and "}\"), optionally in locations such as user Roaming/AppData or Local Temp. Such GUID-named directories are often used to stage payloads or hide artifacts under uncommon-looking paths. It relies on process creation telemetry, matching on the CommandLine and Image fields while excluding cases involving common installer-driven binaries (drvinst.exe, msiexec.exe) and invalid image entries.
references:
  - https://twitter.com/Kostastsale/status/1565257924204986369
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_execution_from_guid_folder_names.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-01
modified: 2023-03-02
tags:
  - attack.stealth
  - attack.t1027
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_folder:
    CommandLine|contains:
      - \AppData\Roaming\
      - \AppData\Local\Temp\
  selection_guid:
    CommandLine|contains|all:
      - \{
      - "}\\"
  filter_main_image_guid:
    Image|contains|all:
      - \{
      - "}\\"
  filter_main_null:
    Image: null
  filter_main_driver_inst:
    Image: C:\Windows\System32\drvinst.exe
  filter_main_msiexec:
    Image:
      - C:\Windows\System32\msiexec.exe
      - C:\Windows\SysWOW64\msiexec.exe
  condition: all of selection_* and not 1 of filter*
falsepositives:
  - Installers are sometimes known for creating temporary folders with GUID like names. Add appropriate filters accordingly
level: low
license: DRL-1.1
related:
  - id: 90b63c33-2b97-4631-a011-ceb0f47b77c3
    type: derived