Windows Formbook-style process execution deleting dropped payloads from AppData Temp via cmd
Flags Windows process creation where an .exe runs deletion commands to remove dropper artifacts from AppData Temp/Desktop.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro (SigmaHQ), DRL 1.1
- Published
- 2019-09-30
- Updated
- 2026-07-31
ATT&CK techniques
Resource DevRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
Identifies Windows process creation where a .exe from System32 or SysWOW64 spawns a child process whose command line uses cmd to delete a dropped payload in user AppData local Temp. The rule also covers deletion from the Desktop using cmd constructs like /c del and type nul > redirection. This matters because malware often cleans up dropper artifacts after code execution, and the detection relies on process creation telemetry including parent and child command lines plus the specified path and cmd parameters.
Reporting behind it
- inquest.nethttps://inquest.net/blog/2018/06/22/a-look-at-formbook-stealer
- app.any.runhttps://app.any.run/tasks/388d5802-aa48-4826-b069-250420504758/
- app.any.runhttps://app.any.run/tasks/8e22486b-5edc-4cef-821c-373e945f296c/
- app.any.runhttps://app.any.run/tasks/62bb01ae-25a4-4180-b278-8e464a90b8d7/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/Formbook/proc_creation_win_malware_formbook.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Formbook-style process execution deleting dropped payloads from AppData Temp via cmd
id: 241a2a2f-93bc-4581-8613-98b591895d29
status: test
description: Identifies Windows process creation where a .exe from System32 or SysWOW64 spawns a child process whose command line uses cmd to delete a dropped payload in user AppData local Temp. The rule also covers deletion from the Desktop using cmd constructs like /c del and type nul > redirection. This matters because malware often cleans up dropper artifacts after code execution, and the detection relies on process creation telemetry including parent and child command lines plus the specified path and cmd parameters.
references:
- https://inquest.net/blog/2018/06/22/a-look-at-formbook-stealer
- https://app.any.run/tasks/388d5802-aa48-4826-b069-250420504758/
- https://app.any.run/tasks/8e22486b-5edc-4cef-821c-373e945f296c/
- https://app.any.run/tasks/62bb01ae-25a4-4180-b278-8e464a90b8d7/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/Formbook/proc_creation_win_malware_formbook.yml
author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro, Huntrule Team
date: 2019-09-30
modified: 2022-10-06
tags:
- attack.resource-development
- attack.t1587.001
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection1:
ParentCommandLine|startswith:
- C:\Windows\System32\
- C:\Windows\SysWOW64\
ParentCommandLine|endswith: .exe
selection2:
- CommandLine|contains|all:
- /c
- del
- C:\Users\
- \AppData\Local\Temp\
- CommandLine|contains|all:
- /c
- del
- C:\Users\
- \Desktop\
- CommandLine|contains|all:
- /C
- type nul >
- C:\Users\
- \Desktop\
selection3:
CommandLine|endswith: .exe
condition: all of selection*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 032f5fb3-d959-41a5-9263-4173c802dc2b
type: derived