Windows process creation matching specific Peach Sandstorm command-line indicator
Alerts on Windows process creations whose command line contains a specific suspicious substring.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- process_creation
- Author
- X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-01-15
- Updated
- 2026-07-31
What it detects
This rule flags Windows process creation events where the process command line contains the exact suspicious string pattern 'QP''s\*(58vaP!tF4'. Attackers may use distinctive command-line arguments or embedded payload markers during execution, so matching these strings can help surface related activity. The detection relies on process creation telemetry that includes the full command line.
Reporting behind it
- twitter.comhttps://twitter.com/MsftSecIntel/status/1737895710169628824
- virustotal.comhttps://www.virustotal.com/gui/file/364275326bbfc4a3b89233dabdaf3230a3d149ab774678342a40644ad9f8d614/details
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Peach-Sandstorm/proc_creation_win_apt_peach_sandstorm_indicators.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-with-specific-suspicious-command-line-string-2e7bbd54
title: Windows process creation matching specific Peach Sandstorm command-line indicator
id: ed72ac33-6c2b-4986-8c57-4cef5a287c60
status: test
description: This rule flags Windows process creation events where the process command line contains the exact suspicious string pattern 'QP''s\*(58vaP!tF4'. Attackers may use distinctive command-line arguments or embedded payload markers during execution, so matching these strings can help surface related activity. The detection relies on process creation telemetry that includes the full command line.
references:
- https://twitter.com/MsftSecIntel/status/1737895710169628824
- https://www.virustotal.com/gui/file/364275326bbfc4a3b89233dabdaf3230a3d149ab774678342a40644ad9f8d614/details
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Peach-Sandstorm/proc_creation_win_apt_peach_sandstorm_indicators.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2024-01-15
tags:
- attack.execution
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains: QP's\*(58vaP!tF4
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 2e7bbd54-2f26-476e-b4a1-ba5f1a012614
type: derived