Windows Sandbox Configuration File in Suspicious Location

Detects .wsb configuration files created in common staging directories used by attackers for malware deployment.

Sigma