name: Powershell created a temp file
id: 3155539d-31bd-429e-81f9-c17ee1c01f93
version: 1.0.0
condition: >
  sequence
  maxspan 100ms
  |kevt.name = 'CreateProcess' and ps.name = 'powershell.exe'| by ps.pid
  |kevt.name = 'CreateFile'
      and
   file.name icontains 'temp'
  | by ps.pid
min-engine-version: 2.0.0
