Malware creates a randomized directory within the appdata roaming directory and launches the malware. Should see multipl

Hunt Hypothesis

This hunt targets adversaries establishing persistence by generating randomized directories in the AppData\Roaming folder to execute malware via rundll32.exe or iexplore.exe, mimicking legitimate user activity. Proactively hunting for this pattern in Azure Sentinel is critical because low-severity, repetitive process creation events can easily be overlooked, allowing stealthy initial infections to evade standard alert thresholds before spreading laterally.

YARA Rule

rule PlugX_mw
{ 
	meta:
		maltype = "plugX"
		author = "https://github.com/reed1713"
		reference = "http://www.fireeye.com/blog/technical/targeted-attack/2014/02/operation-greedywonk-multiple-economic-and-foreign-policy-sites-compromised-serving-up-flash-zero-day-exploit.html"
		description = "Malware creates a randomized directory within the appdata roaming directory and launches the malware. Should see multiple events for create process rundll32.exe and iexplorer.exe as it repeatedly uses iexplorer to launch the rundll32 process."
	strings:
		$type="Microsoft-Windows-Security-Auditing"
		$eventid="4688"
		$data=/\\AppData\\Roaming\\[0-9]{9,12}\VMwareCplLauncher\.exe/

		$type1="Microsoft-Windows-Security-Auditing"
		$eventid1="4688"
		$data1="\\Windows\\System32\\rundll32.exe"

		$type2="Microsoft-Windows-Security-Auditing"
		$eventid2="4688"
		$data2="Program Files\\Internet Explorer\\iexplore.exe"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the “Malware creates randomized directory in AppData Roaming” detection rule, along with suggested filters and exclusions:

Microsoft Office Click-to-Run Updates
- Scenario: The Microsoft Office Click-to-Run service frequently generates temporary directories with random GUIDs (e.g., C:\Users\<User>\AppData\Roaming\Microsoft\Office\ClickToRun\{Random-GUID}\) to stage updates or install add-ins. During this process, it often invokes rundll32.exe to load specific DLLs for configuration or deployment tasks, mimicking the malware behavior of creating a random folder and launching an executable.
- Suggested Filter: Exclude events where the parent process is OfficeClickToRun.exe (Microsoft Office Click-to-Run) OR the file path contains \Microsoft\Office\ClickToRun\. Additionally, filter for specific SHA256 hashes of known Microsoft-signed DLLs being loaded by rundll32.exe.
Antivirus Real-Time Scanning and Quarantine Operations
- Scenario: Endpoint Protection platforms (such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender) often create isolated, randomized subdirectories within the user’s AppData Roaming folder to stage files for deep scanning or to quarantine suspicious artifacts. These agents frequently spawn rundll32.exe instances to execute scanning engines or policy updates within these temporary directories.
- Suggested Filter: Create an exclusion based on the parent process name (e.g., CortexAgent.exe, SentinelOne.exe, MsMpEng.exe) and exclude paths containing specific vendor identifiers like \CrowdStrike\, \SentinelOne\, or \Microsoft Defender Antivirus\.
Adobe Creative Cloud Updater
- Scenario: The Adobe Creative Cloud desktop