Potential Suspicious Execution From GUID-Like Folder Names

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•27

Detects potential suspicious execution of a process from a GUID-like folder name located in a suspicious temporary directory, a technique observed in IcedID attacks. This rule is designed to identify uncommon and potentially malicious activity stemming from such folders.