Rule Info
Name
Non-Standard TEMP or TMP Environment Variable
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects TEMP or TMP environment variables set to a non-standard value.
Attackers may redirect these variables to a malicious directory to control where temporary files are written, potentially enabling privilege escalation or persistence.
Date
2026-09-23 00:00:00
Modified
None
Id
8e0e9421-38c3-4e86-9293-91221e292098
Tags
attack.persistence attack.privilege-escalation attack.execution attack.stealth attack.t1574.007
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR