Executables Or Script Creation In Temp Path

SPLUNK detection rule by Teoderick Contreras, Splunk · Apache-2.0

The following analytic identifies the creation of executables or scripts in temporary file paths on Windows systems. It leverages the Endpoint.Filesystem data set to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in temporary directories (e.g., \windows\Temp\, \AppData\Local\Temp\). This activity can be significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.

name: Executables Or Script Creation In Temp Path
id: e0422b71-2c05-4f32-8754-01fb415f49c9
version: 27
creation_date: '2021-05-07'
modification_date: '2026-08-14'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |
    The following analytic identifies the creation of executables or scripts in temporary file paths on Windows systems. It leverages the Endpoint.Filesystem data set to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in temporary directories (e.g., \windows\Temp\, \AppData\Local\Temp\).
    This activity can be significant as adversaries often use these paths to evade detection and maintain persistence.
    If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
data_source:
    - Sysmon EventID 11
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
    from datamodel=Endpoint.Filesystem where

    Filesystem.action= "created"
    Filesystem.file_name IN (
        "*.bat",
        "*.cmd",
        "*.com",
        "*.dll",
        "*.exe",
        "*.js",
        "*.msc",
        "*.pif",
        "*.ps1",
        "*.sys",
        "*.vbe",
        "*.vbs"
    )
    Filesystem.file_path IN (
        "*:\\Temp\\*",
        "*:\\Windows\\Temp\\*",
        "*\\AppData\\Local\\Temp\\*"
    )
    NOT Filesystem.file_path IN ("*\\__PSScriptPolicyTest_*")

    by Filesystem.action Filesystem.dest Filesystem.file_access_time
       Filesystem.file_create_time Filesystem.file_hash
       Filesystem.file_modify_time Filesystem.file_name
       Filesystem.file_path Filesystem.file_acl
       Filesystem.file_size Filesystem.process_guid
       Filesystem.process_id Filesystem.user
       Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `executables_or_script_creation_in_temp_path_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
known_false_positives: Executable creation and certain script extensions in temporary paths can very common in certain environments and legitimate use cases. It is important to review and filter these events based on your organization''s normal activity and policies.
references:
    - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
    - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
    - https://twitter.com/pr0xylife/status/1590394227758104576
    - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
drilldown_searches:
    - name: View the detection results for - "$user$"
      search: '%original_detection_search% | search  user = "$user$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$user$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: '0'
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Executable or script with file name $file_name$ located $file_path$ and process_id $process_id$ was created in temporary folder by $user$
threat_objects:
    - field: file_name
      type: file_name
    - field: file_path
      type: file_path
analytic_story:
    - Snake Keylogger
    - China-Nexus Threat Activity
    - Remcos
    - LockBit Ransomware
    - AsyncRAT
    - DarkCrystal RAT
    - Derusbi
    - WinDealer RAT
    - DarkGate Malware
    - AcidPour
    - ValleyRAT
    - Crypto Stealer
    - PlugX
    - Data Destruction
    - Qakbot
    - CISA AA23-347A
    - Hermetic Wiper
    - Volt Typhoon
    - Double Zero Destructor
    - NjRAT
    - Trickbot
    - Meduza Stealer
    - AgentTesla
    - SnappyBee
    - Azorult
    - WhisperGate
    - Warzone RAT
    - Swift Slicer
    - Rhysida Ransomware
    - Brute Ratel C4
    - BlackByte Ransomware
    - Graceful Wipe Out Attack
    - Chaos Ransomware
    - Handala Wiper
    - RedLine Stealer
    - Salt Typhoon
    - XMRig
    - MoonPeak
    - Industroyer2
    - Amadey
    - IcedID
    - Interlock Rat
    - APT37 Rustonotto and FadeStealer
    - PromptLock
    - Lokibot
    - SesameOp
    - PromptFlux
    - XML Runner Loader
    - Void Manticore
    - Axios Supply Chain Post Compromise
    - VIP Keylogger
    - RoguePlanet
    - Salat Stealer
    - Phantom Stealer
    - Vidar Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1036
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
          sourcetype: XmlWinEventLog
      test_type: unit

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f3fcc0c1-a313-43a7-ad6d-ec7dae87112b

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion