Detection of Malicious Executables and Scripts in Temporary Directories

Adversaries often exploit temporary system directories, such as \Temp, \Windows\Temp, and \AppData\Local\Temp, to facilitate the execution of malicious payloads. Because these directories are intended for transient data, they are frequently used as staging areas to hide executables, DLLs, and scripts used for persistence or lateral movement. Threat actors ranging from ransomware operators like LockBit and Rhysida to commodity malware such as Remcos and AsyncRAT use these paths to drop binaries and scripts that avoid more strictly monitored application directories. Detection is crucial for identifying unauthorized code execution, privilege escalation attempts, and persistent backdoor installations within an environment.

Attack Chain

1. An attacker gains initial access, often via phishing or exploited services.
2. The attacker uses built-in tools or custom droppers to download or move malicious binaries to a temporary directory.
3. A malicious file (e.g., .exe, .ps1, .vbs) is written to a temporary path (e.g., \AppData\Local\Temp).
4. The attacker sets the file attribute or modifies execution permissions if necessary.
5. The attacker executes the payload, often via command-line invocation or scheduled task.
6. The payload performs its objective, such as credential theft, data destruction, or establishing C2.

Impact

Successful exploitation of this technique can lead to full system compromise, ransomware deployment, data exfiltration, or the establishment of persistent backdoors. These activities have been observed across a wide range of sectors, targeting both critical infrastructure and general enterprise environments, with significant potential for operational disruption and financial loss.

Recommendation

Deploy detection rules to monitor for file creation events within temporary directories and cross-reference these with process execution telemetry.

• Enable Sysmon Event ID 11 (FileCreate) to log file system activity in all temporary directories.
• Integrate endpoint logs into a SIEM using a normalized data model (e.g., CIM) to enable monitoring of file creation events.
• Investigate any occurrences where non-standard binaries or scripts are created in temporary paths, particularly when associated with suspicious parent processes.
• Use the provided Sigma rule to alert on unauthorized file creations and tune out legitimate temp file activity based on known-good baseline behavior.