Suspicious Execution from Public Folder by Scripting/Shell Binary
Detects a potentially suspicious execution where a parent process located in the "\Users\Public" folder executes a child process that is a common shell or scripting binary, indicated by its image name or command line arguments. This behavior is often associated with malware attempting to hide in a publicly accessible directory and then execute further malicious commands.
Sigma
