Suspicious File Execution from Public and Downloads Folder

Ethan Anderson@ethan

•updated Jul 17, 2025•5•2•81

This rule detects suspicious activity where a file is first downloaded to the 'Downloads' folder and subsequently executed from the 'Public' folder on the same device within a 24-hour timeframe. This behavior can indicate an attempt to bypass security controls or stage malicious payloads in a commonly accessible location.