Execution of Executables or Scripts from Suspicious Writable Directories
This rule detects the creation of executable files (.exe, .dll, .ps1) in common writable and potentially transient directories such as Temp, AppData, ProgramData, or Users\Public. It further correlates these file events with process creation events using the file hash to identify instances where such files are subsequently executed.
Microsoft Sentinel (KQL)
