name: Command shell created a temp file
id: 40ffc2a8-0bde-45c4-9e20-46158250fa91
version: 1.0.0
condition: >
  sequence
  maxspan 200ms
  by ps.pid
    |kevt.name = 'CreateProcess' and ps.name = 'cmd.exe'|
    |kevt.name = 'CreateFile'
      and
     file.name icontains 'temp'
    |
min-engine-version: 2.0.0
