Rule Info
Name
TEMP or TMP Environment Variable Tampering via Registry
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects modifications to the TEMP or TMP environment variables via registry.
Attackers may redirect these variables to a malicious directory to control where temporary files are written, potentially enabling privilege escalation or persistence.
Date
2026-09-23 00:00:00
Modified
None
Id
527dc2ca-abd3-4c29-a5eb-52522b931763
Tags
attack.persistence attack.privilege-escalation attack.execution attack.stealth attack.t1574.007
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR