Windows Suspicious File Creation in AppData Outside Common Subdirectories
Alerts on new .exe/.dll/.ps1/.lnk and other files created under unusual AppData locations outside Local/LocalLow/Roaming.
FreeReviewedSigma · High · v2
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-05
- Updated
- 2026-07-31
What it detects
This rule flags file events where a new file path is under a user’s AppData directory but not within the commonly used AppData\Local, AppData\LocalLow, or AppData\Roaming subfolders. Attackers may use less typical AppData locations to hide or stage payloads while reducing overlap with analyst-tuned detections. It relies on Windows file event telemetry that captures the full target filename, with detection constrained to specific executable and script-like extensions.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-suspicious-script-executable-file-creation-in-non-standard-appdata-paths-d7b50671
title: Windows Suspicious File Creation in AppData Outside Common Subdirectories
id: 7cc942f9-b02d-455c-812b-1a4a1e00575c
status: test
description: This rule flags file events where a new file path is under a user’s AppData directory but not within the commonly used AppData\Local, AppData\LocalLow, or AppData\Roaming subfolders. Attackers may use less typical AppData locations to hide or stage payloads while reducing overlap with analyst-tuned detections. It relies on Windows file event telemetry that captures the full target filename, with detection constrained to specific executable and script-like extensions.
references:
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_new_files_in_uncommon_appdata_folder.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-05
modified: 2023-02-23
tags:
- attack.execution
- attack.stealth
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|startswith: C:\Users\
TargetFilename|contains: \AppData\
TargetFilename|endswith:
- .bat
- .cmd
- .cpl
- .dll
- .exe
- .hta
- .iso
- .lnk
- .msi
- .ps1
- .psm1
- .scr
- .vbe
- .vbs
filter_main:
TargetFilename|startswith: C:\Users\
TargetFilename|contains:
- \AppData\Local\
- \AppData\LocalLow\
- \AppData\Roaming\
condition: selection and not filter_main
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: d7b50671-d1ad-4871-aa60-5aa5b331fe04
type: derived