Casbaneiro infection marker folder created in %PUBLIC%

Ankit Mehta@Secvyn

•updated 25 days ago•0•0•2

This rule detects the creation of files within the '\Users\Public\' directory that follow a specific, suspicious dynamic naming pattern: 'DeviceName@4AccountName'. Attackers often use the Public directory for staging malicious tools or payloads. This naming convention, which includes both the hostname and the executing account name, is highly indicative of automated, malicious activity or custom staging scripts.