1200KM / sigma-rule

Sysprep on AppData Folder — Sigma Rule

Sigma rule d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e. Sysprep on AppData Folder — Sigma Rule. Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec)

Rule metadata and linked tags

Author: Florian Roth (Nextron Systems). Source status: test; severity: medium. Source dates: 2018-06-22 / 2021-11-27.

{
  "category": "process_creation",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 19ebe64867d1e0d5bd0fd78762062029216df439dbb08d15f18648e6678ff3db

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Sysprep on AppData Folder
id: d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e
status: test
description: Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec)
references:
    - https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets
    - https://app.any.run/tasks/61a296bb-81ad-4fee-955f-3b399f4aaf4b
author: Florian Roth (Nextron Systems)
date: 2018-06-22
modified: 2021-11-27
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\sysprep.exe'
        CommandLine|contains: '\AppData\'
    condition: selection
falsepositives:
    - False positives depend on scripts and administrative tools used in the monitored environment
level: medium

Original YAML and metadata in JSON

False positives

False positives depend on scripts and administrative tools used in the monitored environment

Source references

Connected ecosystem references

Exact source-tagged techniques

T1059 · Command and Scripting Interpreter · Detection rules & anomalies

Telemetry review

Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.