Windows Suspicious Process Execution Using GUID-Like Folder Names in %TEMP% or AppData

title: Windows Suspicious Process Execution Using GUID-Like Folder Names in %TEMP% or AppData
id: d69f74a9-768d-444a-9c46-5326fc85d90b
status: test
description: This rule flags process creation events where the command line contains a GUID-like folder pattern ("{...}" followed by a backslash) and the activity also references suspicious user-writable locations such as AppData\Roaming or AppData\Local\Temp. GUID-named temporary folders are commonly used to stage or execute payloads from transient directories, helping attackers blend in with seemingly random filesystem artifacts. It relies on Windows process creation telemetry, matching process command lines and excluding specific installer-related execution patterns based on the image path.
references:
  - https://twitter.com/Kostastsale/status/1565257924204986369
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_execution_from_guid_folder_names.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-01
modified: 2023-03-02
tags:
  - attack.stealth
  - attack.t1027
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_folder:
    CommandLine|contains:
      - \AppData\Roaming\
      - \AppData\Local\Temp\
  selection_guid:
    CommandLine|contains|all:
      - \{
      - "}\\"
  filter_main_image_guid:
    Image|contains|all:
      - \{
      - "}\\"
  filter_main_null:
    Image: null
  filter_main_driver_inst:
    Image: C:\Windows\System32\drvinst.exe
  filter_main_msiexec:
    Image:
      - C:\Windows\System32\msiexec.exe
      - C:\Windows\SysWOW64\msiexec.exe
  condition: all of selection_* and not 1 of filter*
falsepositives:
  - Installers are sometimes known for creating temporary folders with GUID like names. Add appropriate filters accordingly
level: low
license: DRL-1.1
related:
  - id: 90b63c33-2b97-4631-a011-ceb0f47b77c3
    type: derived