Temporary Downloader Executable In Tempappdata
Detects the creation of an executable file in temporary directories (temp or appdata\local\temp) that is then executed by cmd, powershell, or another executable. This pattern is often observed with malware downloaders that stage and execute their payloads in temporary locations.
YARA-L
