{"id":"a6a39bdb-935c-4f0a-ab77-35f4bbf44d33","title":"Potentially Suspicious Powershell Script Execution From Temp Folder","description":"Detects a potentially suspicious powershell script executions from temporary folder","author":"Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton","status":"test","level":"medium","date":"2021-07-14","modified":"2026-02-17","tags":["attack.execution","attack.t1059.001"],"technique_ids":["T1059.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Administrative scripts"],"references":["https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/"],"source_path":"rules/windows/process_creation/proc_creation_win_powershell_script_exec_from_temp_folder.yml","source_sha256":"b1db6cff228d97b94a2c6f73894b3d9e5b294df06a00095bb8318ff771b4e594","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_script_exec_from_temp_folder.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potentially Suspicious Powershell Script Execution From Temp Folder\nid: a6a39bdb-935c-4f0a-ab77-35f4bbf44d33\nstatus: test\ndescription: Detects a potentially suspicious powershell script executions from temporary folder\nreferences:\n    - https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/\nauthor: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton\ndate: 2021-07-14\nmodified: 2026-02-17\ntags:\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith:\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n        CommandLine|contains:\n            - '\\Windows\\Temp'\n            - '\\Temporary Internet'\n            - '\\AppData\\Local\\Temp'\n            - '\\AppData\\Roaming\\Temp'\n            - '%TEMP%'\n            - '%TMP%'\n            - '%LocalAppData%\\Temp'\n    filter_optional_vscode:\n        CommandLine|contains: '-WindowStyle hidden -Verb runAs'\n    filter_optional_amazon_ec2:\n        CommandLine|contains: '\\Windows\\system32\\config\\systemprofile\\AppData\\Local\\Temp\\Amazon\\EC2-Windows\\'\n    filter_optional_generic:\n        CommandLine|contains:\n            - ' >'\n            - 'Out-File'\n            - 'ConvertTo-Json'\n    filter_optional_chocolatey_installer:\n        ParentImage:\n            - 'C:\\Windows\\System32\\Msiexec.exe'\n            - 'C:\\Windows\\SysWOW64\\Msiexec.exe'\n        Image|endswith: '\\powershell.exe'\n        CommandLine|contains|all:\n            - '-NoProfile -ExecutionPolicy Bypass -Command'\n            - 'AppData\\Local\\Temp\\'\n            - 'Install-Chocolatey.ps1'\n    condition: selection and not 1 of filter_optional_*\nfalsepositives:\n    - Administrative scripts\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/a6a39bdb-935c-4f0a-ab77-35f4bbf44d33.json","kind":"sigma"}