Elevated process started from a writable installer staging directory

1title: Elevated process started from a writable installer staging directory2id: 64f96cc4-1d2f-47fc-8238-e1daf785395c3status: experimental4description: |5  Matches Sysmon Process Creation where a process running at High or System6  integrity was started out of one of the directories a self-extracting7  installer unpacks into — the per-user %TEMP% tree, or C:\Windows\Temp. That is8  the payoff step of this technique: a binary sitting in a directory whose9  permissions let any standard user overwrite it is then executed by the10  installer under the installer's own elevated token. The two path values are11  MITRE's MonitoredDirectories knob. MITRE names %TEMP% there; the second value,12  C:\Windows\Temp, is added by this rule because that is where %TEMP% resolves13  for an installer running as SYSTEM, and the technique text names neither it nor14  any other absolute path. The knob's third suggested value,15  C:\ProgramData, is deliberately left out, because the vendor updaters that16  live there and run as SYSTEM would swamp everything else the rule returns.17  IntegrityLevel is the only field on this event that separates the interesting18  case from a user running something ordinary out of their own temp directory,19  so it carries the whole discriminating weight of the rule. Three limits are20  structural. Nothing on a process-creation event distinguishes a planted binary21  from the installer's own legitimate payload, so this is a hunting filter, not22  an alert. The file-overwrite half of AN0108 arrives as a separate Sysmon File23  Creation event, and joining it to the execution inside MITRE's TimeWindow knob24  is a correlation lib/sigma has no way to express. And the DLL variant — where25  the elevated installer loads a replaced library rather than executing a26  replaced EXE — is invisible from here and would need the Module Load source27  instead. Requires Sysmon with Process Creation enabled and IntegrityLevel28  carried through the field mapping; if that field is dropped in normalisation29  the selection silently never matches, which reads as quiet when it means30  blind.31  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0038, not hand-written and not tested by its author. Any lab result is on this rule's own page.32references:33  - https://attack.mitre.org/techniques/T1574/00534  - https://attack.mitre.org/detectionstrategies/DET003835author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)36date: 2026-08-1637tags:38  - attack.defense-evasion39  - attack.execution40  - attack.t1574.00541logsource:42  category: process_creation43  product: windows44detection:45  selection:46    IntegrityLevel:47      - 'High'48      - 'System'49    Image|contains:50      - '\AppData\Local\Temp\'51      - ':\Windows\Temp\'52  condition: selection53falsepositives:54  - "Ordinary software installation. Self-extracting installers built with NSIS, Inno Setup, InstallShield or 7-Zip SFX unpack into a randomly named %TEMP% subdirectory and execute the unpacked setup binary through the elevation prompt, which is precisely the shape this rule matches. On any estate where users install their own software this is the highest-volume match by a wide margin, and it is why the level is low rather than medium."55  - "Software deployment and patching agents running as SYSTEM. ConfigMgr, Intune, WinGet and Chocolatey stage vendor bundles into C:\\Windows\\Temp and launch them there on every deployment, so each patch window produces a burst of System-integrity matches across the whole fleet."56  - "Windows Installer custom actions. msiexec extracts embedded executables into a temporary directory and runs them inside the elevated install session, so any MSI carrying a custom action matches once per install and once per repair."57  - "Vendor firmware, driver and diagnostic utilities — Dell Command Update, HP Image Assistant, Lenovo System Update and similar — which unpack their payload into Windows\\Temp and run it as SYSTEM on a scheduled cadence."58level: low