Elevated process started from a writable installer staging directory

Siemphony@siemphonylowT1574.005unverified

Matches Sysmon Process Creation where a process running at High or System integrity was started out of one of the directories a self-extracting installer unpacks into — the per-user %TEMP% tree, or C:\Windows\Temp. That is the payoff step of this technique: a binary sitting in a directory whose permissions let any standard user overwrite it is then executed by the installer under the installer's own elevated token. The two path values are MITRE's MonitoredDirectories knob. MITRE names %TEMP% there; the second value, C:\Windows\Temp, is added by this rule because that is where %TEMP% resolves for an installer running as SYSTEM, and the technique text names neither it nor any other absolute path. The knob's third suggested value, C:\ProgramData, is deliberately left out, because the vendor updaters that live there and run as SYSTEM would swamp everything else the rule returns. IntegrityLevel is the only field on this event that separates the interesting case from a user running something ordinary out of their own temp directory, so it carries the whole discriminating weight of the rule. Three limits are structural. Nothing on a process-creation event distinguishes a planted binary from the installer's own legitimate payload, so this is a hunting filter, not an alert. The file-overwrite half of AN0108 arrives as a separate Sysmon File Creation event, and joining it to the execution inside MITRE's TimeWindow knob is a correlation lib/sigma has no way to express. And the DLL variant — where the elevated installer loads a replaced library rather than executing a replaced EXE — is invisible from here and would need the Module Load source instead. Requires Sysmon with Process Creation enabled and IntegrityLevel carried through the field mapping; if that field is dropped in normalisation the selection silently never matches, which reads as quiet when it means blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0038, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((ProcessIntegrityLevel =~ "High" or ProcessIntegrityLevel =~ "System") and (FolderPath contains "\\AppData\\Local\\Temp\\" or FolderPath contains ":\\Windows\\Temp\\"))

Splunk · SPL

Run this as a search.

index=* ((IntegrityLevel="High" OR IntegrityLevel="System") AND (Image="*\\AppData\\Local\\Temp\\*" OR Image="*:\\Windows\\Temp\\*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(IntegrityLevel) == "high" OR TO_LOWER(IntegrityLevel) == "system") AND (TO_LOWER(process.executable) LIKE "*\\\\appdata\\\\local\\\\temp\\\\*" OR TO_LOWER(process.executable) LIKE "*:\\\\windows\\\\temp\\\\*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="IntegrityLevel" type="pcre2">(?i)(^High$|^System$)</field>    <field name="Image" type="pcre2">(?i)(\\AppData\\Local\\Temp\\|:\\Windows\\Temp\\)</field>    <description>Elevated process started from a writable installer staging directory</description>    <mitre>      <id>T1574.005</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: registry_persistence
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 64f96cc4-1d2f-47fc-8238-e1daf785395c

ATT&CKT1574.005

T1574.005Executable Installer File Permissions Weakness

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

A process running at High or System integrity that was started out of a directory a self-extracting installer unpacks into — the per-user %TEMP% tree or C:\Windows\Temp. That is the payoff step of this technique: a binary sitting in a directory whose permissions let any standard user overwrite it is then executed by the installer under the installer's own elevated token. Nothing on a process-creation event separates a planted binary from the installer's genuine payload, so read this as a hunting filter, not an alert.

02 · Telemetry you need

Sysmon Process Creation (EID 1) — the process_creation / windows logsource from the brief. Two fields carry the whole rule: Image and IntegrityLevel. IntegrityLevel is doing all of the discriminating work, and it is also the field most likely to be lost in normalisation; if it is dropped, the selection silently never matches and you get a clean-looking zero. Confirm it survives end to end before drawing any conclusion from a quiet result. Security 4688 is not a substitute here — it carries no integrity level at all.

03 · How the logic works

One selection with two conditions, implicitly ANDed. IntegrityLevel must be High or System. Image|contains must hit \AppData\Local\Temp\ or :\Windows\Temp\. The paths come from MITRE's MonitoredDirectories knob: MITRE names %TEMP%, while C:\Windows\Temp is this rule's own addition, being where %TEMP% resolves for an installer running as SYSTEM. The knob's third suggested value, C:\ProgramData, is deliberately left out — the vendor updaters that live there and run as SYSTEM would swamp everything else. Note the single backslashes in the detection block: in Sigma a lone backslash is already a literal, so do not "fix" them by doubling.

04 · Common false positives

Ordinary installation, which produces the same event shape as the true positive. NSIS, Inno Setup, InstallShield and 7-Zip SFX all unpack into a randomly named %TEMP% subdirectory and run the setup binary through the elevation prompt. Deployment and patching agents — ConfigMgr, Intune, WinGet, Chocolatey — stage vendor bundles into Windows\Temp and launch them as SYSTEM every patch window, fleet-wide. msiexec custom actions match once per install and once per repair. Vendor firmware and driver utilities do the same on a schedule. On any estate where users install their own software, this is the highest-volume match by a wide margin.

05 · Detection maturity

tier_1: Lowest tier. Derived from MITRE ATT&CK DET0038 and never executed against a log line. Its loudest false positive and its true positive are the same event, so the rule's real value today is as a hunt that characterises your own installer baseline. Run it for a fortnight, build the parent allowlist from what comes back, and only then ask whether it could ever be an alert.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Narrow the logic; do not carve away the paths. ParentImage is the most useful lever available on EID 1 — a small allowlist of known bootstrappers and deployment agents strips most of the volume without touching the adversary case. An OriginalFileName that disagrees with Image is a second discriminator worth adding. Then accept the structural gaps rather than trying to close them here. The file-overwrite half of AN0108 arrives as a separate Sysmon File Creation (EID 11) event, and joining it to the execution inside MITRE's TimeWindow knob is a correlation lib/sigma cannot express. The DLL variant — the elevated installer side-loading a replaced library instead of executing a replaced EXE — lands on Module Load (EID 7) and is invisible from here. That companion rule is arguably the more canonical shape of the technique, so do not treat T1574.005 as covered by this one.

Declared by the author

Ordinary software installation. Self-extracting installers built with NSIS, Inno Setup, InstallShield or 7-Zip SFX unpack into a randomly named %TEMP% subdirectory and execute the unpacked setup binary through the elevation prompt, which is precisely the shape this rule matches. On any estate where users install their own software this is the highest-volume match by a wide margin, and it is why the level is low rather than medium.
Software deployment and patching agents running as SYSTEM. ConfigMgr, Intune, WinGet and Chocolatey stage vendor bundles into C:\Windows\Temp and launch them there on every deployment, so each patch window produces a burst of System-integrity matches across the whole fleet.
Windows Installer custom actions. msiexec extracts embedded executables into a temporary directory and runs them inside the elevated install session, so any MSI carrying a custom action matches once per install and once per repair.
Vendor firmware, driver and diagnostic utilities — Dell Command Update, HP Image Assistant, Lenovo System Update and similar — which unpack their payload into Windows\Temp and run it as SYSTEM on a scheduled cadence.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1574.005, evaluated against their process_creation events.

Share this rule

/u/siemphony/64f96cc4-1d2f-47fc-8238-e1daf785395c

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Elevated process started from a writable installer staging directory

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it