Windows Sysprep Execution Targeting AppData Directory
Alerts when sysprep.exe runs with an AppData directory present in the command line on Windows.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2018-06-22
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where sysprep.exe is launched with a command line containing an AppData path. Attackers may use sysprep to blend execution into legitimate Windows workflows while operating on user-controlled directories like AppData. Detection relies on Windows process creation telemetry capturing the process image name and command-line arguments.
Reporting behind it
- symantec.comhttps://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets
- app.any.runhttps://app.any.run/tasks/61a296bb-81ad-4fee-955f-3b399f4aaf4b
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysprep_appdata.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-sysprep-execution-targeting-appdata-directory-d5b9ae7a
title: Windows Sysprep Execution Targeting AppData Directory
id: f3c7747d-0ca0-46a0-b401-3e806d835c4b
status: test
description: This rule flags process creation events where sysprep.exe is launched with a command line containing an AppData path. Attackers may use sysprep to blend execution into legitimate Windows workflows while operating on user-controlled directories like AppData. Detection relies on Windows process creation telemetry capturing the process image name and command-line arguments.
references:
- https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets
- https://app.any.run/tasks/61a296bb-81ad-4fee-955f-3b399f4aaf4b
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysprep_appdata.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-06-22
modified: 2021-11-27
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \sysprep.exe
CommandLine|contains: \AppData\
condition: selection
falsepositives:
- False positives depend on scripts and administrative tools used in the monitored environment
level: medium
license: DRL-1.1
related:
- id: d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e
type: derived