Evasive Panda MgBot Install Path ProgramData Microsoft MF
This rule detects the installation path of the Evasive Panda loader/MgBot malware. It specifically looks for file events where the target filename contains '\Microsoft\MF' within the 'ProgramData' directory. To reduce false positives, it excludes file creations by trusted system installers like 'TrustedInstaller.exe' and 'msiexec.exe' when run from 'System32'. The rule also implies that the initiating process should originate from user-space directories or the same '\Microsoft\MF' path, though this is not explicitly enforced in the final condition.
Sigma
