name: Command shell created a temp file with network outbound
id: 372902be-76e9-4ee7-a48a-6275fa571cf4
version: 1.0.0
condition: >
  sequence
  maxspan 200ms
  |kevt.name = 'CreateProcess' and ps.name = 'cmd.exe'| as e1
  |kevt.name = 'CreateFile'
      and
   file.name icontains 'temp'
      and
   $e1.ps.sid = ps.sid
  | as e2
  |kevt.name = 'Connect' and ps.sid != $e2.ps.sid and ps.sid = $e1.ps.sid|
min-engine-version: 2.0.0
