Execution from Deep AppData/Local (T1036)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•2

Identifies anomalous process execution explicitly originating from heavily nested or randomized directories within AppData\LocalLow or Temp, indicating staged payloads. This rule specifically looks for processes executing from paths matching the regex `AppData\Local(Low)?\Temp\[a-f0-9A-Z]{8,}\` and excludes common browser executables like chrome.exe, msedge.exe, and update.exe to reduce false positives.