Sigma rule: Formbook Process Creation

Rule

Title

Formbook Process Creation

Status

test

Level

high

Author

Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro

Date

2019-09-30

Modified

2022-10-06

File

rules-emerging-threats/2019/Malware/Formbook/proc_creation_win_malware_formbook.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects Formbook like process executions that inject code into a set of files in the System32 folder, which executes a special command command line to delete the dropper from the AppData Temp folder. We avoid false positives by excluding all parent process with command line parameters.

Log source

product

windows

category

process_creation

Detection

selection1:
    # Parent command line should not contain a space value
    # This avoids false positives not caused by process injection
    # e.g. wscript.exe /B sysmon-install.vbs
    ParentCommandLine|startswith:
        - 'C:\Windows\System32\'
        - 'C:\Windows\SysWOW64\'
    ParentCommandLine|endswith: '.exe'
selection2:
    - CommandLine|contains|all:
          - '/c'
          - 'del'
          - 'C:\Users\'
          - '\AppData\Local\Temp\'
    - CommandLine|contains|all:
          - '/c'
          - 'del'
          - 'C:\Users\'
          - '\Desktop\'
    - CommandLine|contains|all:
          - '/C'
          - 'type nul >'
          - 'C:\Users\'
          - '\Desktop\'
selection3:
    CommandLine|endswith: '.exe'
condition: all of selection*

False positives (as the rule lists them)

• Unknown

Tags

• attack.resource-development
• attack.t1587.001
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1587.001

References

• https://inquest.net/blog/2018/06/22/a-look-at-formbook-stealer
• https://app.any.run/tasks/388d5802-aa48-4826-b069-250420504758/
• https://app.any.run/tasks/8e22486b-5edc-4cef-821c-373e945f296c/
• https://app.any.run/tasks/62bb01ae-25a4-4180-b278-8e464a90b8d7/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2019/Malware/Formbook/proc_creation_win_malware_formbook.yml