Suspicious Execution From Public Folder

Swachchhanda Shrawan Poudel

Detects execution of suspicious files (like .bat, .exe, .ps1, etc.) from the Public folder, which may indicate execution of dropped malicious payloads. This technique is commonly used by ransomware actors, including BlackBasta, to execute their malware from publicly accessible locations. Legitimate software rarely installs executables in Public folders, making this behavior suspicious.

2025-03-18 00:00:00

None

2db12787-11fe-406e-ba8e-8d4e762106a8

attack.execution attack.t1059.001

Nextron Sigma feed only (private)