Network Connection From Users Public Folder
Detects a network connection initiated from a process located in the "C:\Users\Public" folder. Attackers are known to drop their malicious payloads and malware in this directory as it's writable by everyone. This rule helps hunt for potential suspicious or uncommon activity in the environment.
Sigma
