Suspicious Process Launch From Temp Directory With Numeric And Base64 Arguments

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•1•0•10

This rule targets suspicious process launches where an executable, specifically a `.exe` file, is executed from a temporary directory (e.g., `temp` or `appdata\local\temp`). The detection is further refined by looking for a command line pattern where the executable is followed by a numeric argument (1 to 10 digits) and then a long Base64-like string (at least 40 characters long, optionally padded with '=='). This pattern is often observed in malware that uses temporary files and obfuscated command-line parameters for execution.