Sigma rule: Potential Suspicious Execution From GUID Like Folder Names

Rule

Title

Potential Suspicious Execution From GUID Like Folder Names

Status

test

Level

low

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-09-01

Modified

2023-03-02

File

rules-threat-hunting/windows/process_creation/proc_creation_win_susp_execution_from_guid_folder_names.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential suspicious execution of a GUID like folder name located in a suspicious location such as %TEMP% as seen being used in IcedID attacks.
Use this rule to hunt for potentially suspicious activity stemming from uncommon folders.

Log source

product

windows

category

process_creation

Detection

# Uncomment this section and remove the filter if you want the rule to be more specific to processes
# selection_img:
#     Image|endswith:
#         - '\rundll32.exe'
selection_folder:
    CommandLine|contains:
        # Add more suspicious or unexpected paths
        - '\AppData\Roaming\'
        - '\AppData\Local\Temp\' # This could generate some FP with some installers creating folders with GUID
selection_guid:
    CommandLine|contains|all:
        - '\{'
        - '}\'
filter_main_image_guid:
    Image|contains|all:
        - '\{'
        - '}\'
filter_main_null:
    Image: null
filter_main_driver_inst:  # DrvInst.exe "4" "0" "C:\Users\venom\AppData\Local\Temp\{a0753cc2-fcea-4d49-a787-2290b564b06f}\nvvhci.inf" "9" "43a2fa8e7" "00000000000001C0" "WinSta0\Default" "00000000000001C4" "208" "c:\program files\nvidia corporation\installer2\nvvhci.{eb7b4460-7ec9-42d6-b73f-d487d4550526}"
    Image: 'C:\Windows\System32\drvinst.exe'
filter_main_msiexec:
    Image:
        - 'C:\Windows\System32\msiexec.exe'
        - 'C:\Windows\SysWOW64\msiexec.exe'
condition: all of selection_* and not 1 of filter*

False positives (as the rule lists them)

• Installers are sometimes known for creating temporary folders with GUID like names. Add appropriate filters accordingly

Tags

• attack.stealth
• attack.t1027
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1027

References

• https://twitter.com/Kostastsale/status/1565257924204986369

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_execution_from_guid_folder_names.yml