huntrule

Windows Process Creation: Formbook-style .exe command lines deleting dropper from AppData Temp

Flags Windows process creation where an .exe runs deletion commands to remove dropper artifacts from AppData Temp/Desktop.

FreeUnreviewedSigmahighv1
title: "Windows Process Creation: Formbook-style .exe command lines deleting dropper from AppData Temp"
id: 241a2a2f-93bc-4581-8613-98b591895d29
status: test
description: This rule identifies Windows process executions where the command line ends in an .exe and issues deletion/cleanup commands targeting user AppData Local Temp and Desktop paths. The behavior is consistent with malware removing its dropper after use, which helps reduce forensic artifacts and persistence opportunities. The detection relies on process creation telemetry, specifically parent process command line path constraints and exact command-line substrings such as /c del and redirection patterns like type nul >.
references:
  - https://inquest.net/blog/2018/06/22/a-look-at-formbook-stealer
  - https://app.any.run/tasks/388d5802-aa48-4826-b069-250420504758/
  - https://app.any.run/tasks/8e22486b-5edc-4cef-821c-373e945f296c/
  - https://app.any.run/tasks/62bb01ae-25a4-4180-b278-8e464a90b8d7/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/Formbook/proc_creation_win_malware_formbook.yml
author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro, Huntrule Team
date: 2019-09-30
modified: 2022-10-06
tags:
  - attack.resource-development
  - attack.t1587.001
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    ParentCommandLine|startswith:
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
    ParentCommandLine|endswith: .exe
  selection2:
    - CommandLine|contains|all:
        - /c
        - del
        - C:\Users\
        - \AppData\Local\Temp\
    - CommandLine|contains|all:
        - /c
        - del
        - C:\Users\
        - \Desktop\
    - CommandLine|contains|all:
        - /C
        - type nul >
        - C:\Users\
        - \Desktop\
  selection3:
    CommandLine|endswith: .exe
  condition: all of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 032f5fb3-d959-41a5-9263-4173c802dc2b
    type: derived

What it detects

This rule identifies Windows process executions where the command line ends in an .exe and issues deletion/cleanup commands targeting user AppData Local Temp and Desktop paths. The behavior is consistent with malware removing its dropper after use, which helps reduce forensic artifacts and persistence opportunities. The detection relies on process creation telemetry, specifically parent process command line path constraints and exact command-line substrings such as /c del and redirection patterns like type nul >.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.