BIOC
Informational
✕
Unsigned process running from a temporary directory
Malware often runs from a temporary folder.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Evasion
- Status:
- Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Hide Artifacts: Hidden Files and Directories (T1564.001)
Indicator:
Process action type = execution AND process execution signature = N/A , Unsigned , Invalid Signature AND target process path = *temp* Host host os = windows
Preventable: yes