ERAAgent.exe reads local file from non-standard path SLEEPWALKER RUN_FILE_SCRIPT

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•1

This rule detects suspicious file system activity (creation, modification, or renaming) performed by the ESET Remote Administrator (ERA) Agent process, excluding files within standard ESET installation and ProgramData directories. This behavior may indicate an adversary attempting to leverage the legitimate ERA agent to perform unauthorized file operations or masquerading as the agent.