Process Execution From A Potentially Suspicious Folder
Detects the execution of a process from a directory that is typically not used for legitimate executable files. Adversaries often place their malicious executables in unusual or less-monitored folders to evade detection and blend in with normal system activity. This rule identifies process creations originating from specific suspicious paths like Perflogs, various Users subdirectories, Windows system subdirectories (addins, debug, Fonts, Help, IME, Media, repair, security, Tasks), Recycle Bin, and other less common locations.
Sigma
