Media File Creation in User/Temp Directories

Ankit Mehta@Secvyn

•updated Jun 23, 2026•1•0•6

This rule detects the creation of common media file types (audio and video) within user-specific application data, temporary, or user profile directories. This activity could be indicative of various malicious behaviors, including data exfiltration, staging of malicious payloads, or the dropping of decoy files by malware.