Temporary Executable with Numeric and Base64 Argument Gate

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•0•0•1

This rule detects the execution of temporary executables (from common temporary directories like 'temp' or 'appdata\local\temp') that are launched with a command line containing a numeric argument followed by a long Base64-like token. This pattern is often indicative of malware loaders or droppers attempting to evade detection by using obfuscated arguments.