Executable Creating Another Executable
This rule detects when an executable file (.exe) creates another executable file (.exe). This behavior can be indicative of malicious activity such as malware dropping its components, or legitimate software installers. The rule includes extensive filters to reduce false positives from common system processes, update utilities, and known application behaviors like those from Microsoft Teams, VS Code, and GitHub Desktop.
Sigma
