Creation of 'C:\program.exe' for Unquoted Path Exploitation
This rule detects the creation of an executable file named 'program.exe' directly in the root of the C:\ drive. This specific file name and location are commonly associated with attempts to exploit unquoted service paths, where an attacker places a malicious executable in a higher-level directory to be executed instead of the legitimate program due to the lack of quotation marks in the service path.
Sigma
