Windows Sysprep Execution Targeting AppData Directory

Alerts when sysprep.exe runs with an AppData directory present in the command line on Windows.

FreeUnreviewedSigmamediumv1

windows-sysprep-execution-targeting-appdata-directory-d5b9ae7a

title: Windows Sysprep Execution Targeting AppData Directory
id: f3c7747d-0ca0-46a0-b401-3e806d835c4b
status: test
description: This rule flags process creation events where sysprep.exe is launched with a command line containing an AppData path. Attackers may use sysprep to blend execution into legitimate Windows workflows while operating on user-controlled directories like AppData. Detection relies on Windows process creation telemetry capturing the process image name and command-line arguments.
references:
  - https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets
  - https://app.any.run/tasks/61a296bb-81ad-4fee-955f-3b399f4aaf4b
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysprep_appdata.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-06-22
modified: 2021-11-27
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \sysprep.exe
    CommandLine|contains: \AppData\
  condition: selection
falsepositives:
  - False positives depend on scripts and administrative tools used in the monitored environment
level: medium
license: DRL-1.1
related:
  - id: d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e
    type: derived

What it detects

This rule flags process creation events where sysprep.exe is launched with a command line containing an AppData path. Attackers may use sysprep to blend execution into legitimate Windows workflows while operating on user-controlled directories like AppData. Detection relies on Windows process creation telemetry capturing the process image name and command-line arguments.

Known false positives

False positives depend on scripts and administrative tools used in the monitored environment

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.