Dropping Elephant Staging Files in C:\Users\Public for In-Memory RAT

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects suspicious staging activity by monitoring for the creation of 'editor.dat' files in sensitive directories like C:\Users\Public or C:\Windows\Tasks, or the rapid accumulation of multiple executable files (.exe, .dll, .cpl) within the C:\Users\Public directory, which is a common technique used by attackers to stage tools before execution or lateral movement.