Suspicious Executable Files Execution From Unusual Locations

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects execution of executables files other than .exe, such as '.com', '.scr' etc., from suspicious and uncommon locations that may indicate malicious activity. Malware often uses non-standard executable formats and drops them in temporary or user-accessible locations to evade detection. This rule specifically monitors executions from paths like Temp folders, Downloads, User directories, and Windows system folders that are commonly abused by malware.

2025-03-26 00:00:00

None

3757dfc9-11ff-4b38-8443-80b05a54962b

attack.execution attack.t1204.002 attack.defense-evasion

Nextron Sigma feed only (private)