name: Command shell created a temp file
id: 972902be-76e9-4ee7-a48a-6275fa571cf4
version: 1.0.0
condition: >
  sequence
  maxspan 100ms
  |kevt.name = 'CreateProcess' and ps.name = 'cmd.exe'| by ps.exe
  |kevt.name = 'CreateFile'
      and
   file.name icontains 'temp'
  | by file.name
min-engine-version: 2.0.0
