File Written to User Downloads Folder
Detects any file write event in a user's Downloads folder on Windows endpoints, covering every CrowdStrike Falcon Written event type. Downloads is a common landing spot for payloads from phishing links and drive-by downloads. This is the broad version of the PE file rule and includes it, so it is very noisy and suits threat hunting or investigation pivots more than alerting. To triage, review the event type, file name, writing process, hash and company name.
CQL
