Excessive Number Of Distinct Processes Created In Windows Temp Folder

Excessive Number Of Distinct Processes Created In Windows Temp Folder

Description

This analytic will identify suspicious series of process executions. We have observed that post exploit framework tools like Koadic and Meterpreter will launch an excessive number of processes with distinct file paths from Windows\Temp to execute actions on objective. This behavior is extremely anomalous compared to typical application behaviors that use Windows\Temp.

   Help

Excessive Number Of Distinct Processes Created In Windows Temp Folder Help

To successfully implement this search, you need to be ingesting logs with the full process path in the process field of CIM's Process data model. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.

   Search

Open in Search