Suspicious PowerShell Execution from Temporary Directories

Adversaries frequently utilize temporary directories (e.g., %TEMP%, %TMP%, or AppData\Local\Temp) to stage and execute malicious payloads. Because these directories are generally writable by standard users, they serve as ideal staging grounds for scripts and binaries dropped by initial access vectors. The execution of PowerShell scripts (powershell.exe or pwsh.exe) from these locations is a common TTP used to execute implants, download additional stages, or initiate post-exploitation commands. This brief highlights the need for visibility into command-line arguments when PowerShell processes are launched from non-standard or user-accessible temporary file paths. Defenders should prioritize monitoring these paths for unauthorized execution to disrupt the early stages of the post-compromise lifecycle.

Impact

Successful execution of PowerShell scripts from temporary directories can lead to full host compromise, credential theft, and lateral movement. If left undetected, attackers can maintain persistence or exfiltrate sensitive data. This activity is frequently observed in malware droppers and sophisticated intrusion campaigns.

Recommendation

• Deploy the Sigma rule below to monitor process creation events involving PowerShell execution from temporary directories.
• Tune the detection logic by creating allowlists for known-good administrative scripts or deployment agents (e.g., Chocolatey, EC2 launch agents) to reduce false positives.
• Enable Sysmon or Windows Event Log (Event ID 4688 with command line auditing) to ensure visibility into the full process command line.