Detection Rule is here
NOTE: In my last post, I asked for feedback on my detection logic, but some cybersecurity experts judged my post as AI content and asked for proof. Rather than discussing detection logic, they did everything, and that discussion of ours went south. Still, after all of this, my post reached 30+ likes, so now I want to publish my rule with POC, but I'm unable to add images.
SIGMA RULE:-
title: Suspicious Executable Activity from Temp Directories
id: 42461076-ab43-408d-bc8d-97016a04e2cf
description: Detects unsigned executables in Temp loading modules or DLLs, common in APT29 and malware staging
status: experimental
date: 2026/05/11
author: Manish Rawat
references:
- https://attack.mitre.org/techniques/T1574
- https://github.com/OTRF/Security-Datasets
logsource:
product: windows
category: Image loaded
detection:
selection:
EventID:
- 7
Image|contains:
- \\ProgramData\\
- \\Temp\\
- \\temp\\
selection_ImageLoaded_location:
ImageLoaded|contains:
- \\Temp\\
- \\temp\\
- \\ProgramData\\
selection_ImageLoaded_exe:
ImageLoaded|endswith:
- .exe
- .pyd
selection_signaturestatus:
SignatureStatus:
- 'Unsigned'
- 'Unavailable'
- 'Invalid'
selection_Signed:
Signed:
- 'false'
- '-'
condition:
(selection or selection_ImageLoaded_location)
or (selection_ImageLoaded_exe and (selection_ImageLoaded_location or selection ))
or (selection_signaturestatus and (selection or selection_ImageLoaded_exe or selection_ImageLoaded_location))
or (selection_Signed and (selection or selection_ImageLoaded_exe or selection_ImageLoaded_location))
falsepositives:
- Software installers using temporary directories
- Legitimate portable applications
- Python development environments
severity: medium
tags:
- attack.t1059.006
- attack.t1574
This is the raw lab logic. I am still tuning it for production.
Note: Detecting only double \\Temp\\ logic is making this detection weak (only 24 events triggered), but with individual \\Temp\\ detection, it is getting much more results (300+ events triggered). I know individual \\Temp\\ detection can lead to false positives, but we can narrow it down based on a 90 days or 30 days baseline.
SPL:
(EventID=7 Image IN ("\*\\\\ProgramData\\\\\*", "\*\\\\Temp\\\\\*", "\*\\\\temp\\\\\*")) OR ImageLoaded IN ("\*\\\\Temp\\\\\*", "\*\\\\temp\\\\\*", "\*\\\\ProgramData\\\\\*") OR (ImageLoaded IN ("\*.exe", "\*.pyd") ImageLoaded IN ("\*\\\\Temp\\\\\*", "\*\\\\temp\\\\\*", "\*\\\\ProgramData\\\\\*") OR (EventID=7 Image IN ("\*\\\\ProgramData\\\\\*", "\*\\\\Temp\\\\\*", "\*\\\\temp\\\\\*"))) OR (SignatureStatus IN ("Unsigned", "Unavailable", "Invalid") (EventID=7 Image IN ("\*\\\\ProgramData\\\\\*", "\*\\\\Temp\\\\\*", "\*\\\\temp\\\\\*")) OR ImageLoaded IN ("\*.exe", "\*.pyd") OR ImageLoaded IN ("\*\\\\Temp\\\\\*", "\*\\\\temp\\\\\*", "\*\\\\ProgramData\\\\\*")) OR (Signed IN ("false", "-") (EventID=7 Image IN ("\*\\\\ProgramData\\\\\*", "\*\\\\Temp\\\\\*", "\*\\\\temp\\\\\*")) OR ImageLoaded IN ("\*.exe", "\*.pyd") OR ImageLoaded IN ("\*\\\\Temp\\\\\*", "\*\\\\temp\\\\\*", "\*\\\\ProgramData\\\\\*"))
False Positive:
- Software installers using temporary directories
- Legitimate portable applications
- Python development environments
Tools Worth Monitioring:
- PsExec64.exe
- sdelete64.exe
- PSEXESVC.exe
If you've some suggestion or feedback, please feel free to DM. Detection insights are valuable to me. If you hate this post, then do what you want to do.
