EDR Evasion Artifacts Staged in User Documents Test Folder
This rule detects files commonly associated with endpoint detection and response (EDR) evasion techniques being staged within 'test' subfolders under a user's 'Documents' directory. The presence of such files (executables, DLLs, PowerShell scripts, or binaries) with names indicating 'loader', 'bypass', 'edr', 'inject', 'payload', 'agent', or 'defender' suggests an attacker is preparing to deploy or test EDR evasion tools on the workstation. This activity could precede a larger attack.
Microsoft Sentinel (KQL)
