Sysprep Execution in AppData Folder

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects suspicious execution of 'sysprep.exe' where the command line includes a path within the 'AppData' folder. This behavior has been observed in malware like Trojan Syndicasec, as detailed in Symantec's Thrip report.