Formbook Process Creation and Dropper Deletion
Detects process executions characteristic of Formbook malware. Specifically, it looks for processes originating from System32 or SysWOW64 directories with an executable extension, that then execute a command line containing '/c', 'del', and paths within 'C:\Users\<user>\AppData\Local\Temp\' or 'C:\Users\<user>\Desktop\'. It also covers a variant using '/C' and 'type nul >' for deletion on the Desktop. The rule aims to avoid false positives by excluding parent processes with command line parameters, suggesting an injection scenario where the parent process itself doesn't have complex command line arguments.
Sigma
