MovieReaper File Manager Module - Mass Filesystem Enumeration and Staging

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•1

Detects anomalous mass file enumeration, creation, deletion, and renaming activity within common system or temporary directories, indicative of the MovieReaper stage-4 file manager module. The rule monitors for the execution of command-line utilities (cmd.exe, powershell.exe) with specific file management arguments followed by a high volume of file system operations within a 5-minute window.