Process Execution from Deep AppData Temp

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•1

Identifies anomalous process execution explicitly originating from heavily nested or randomized directories within AppData\LocalLow or Temp, indicating staged payloads. This rule specifically looks for paths matching the pattern AppData\Local(Low)?\Temp\[a-f0-9A-Z]{8,}\ and excludes common browser update processes.