Suspicious File Creation In Uncommon AppData Folder

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•20

Detects the creation of suspicious files and folders inside the user's AppData folder but not within the common and well-known subdirectories (Local, Roaming, LocalLow). This technique can be used by adversaries to bypass detections that exclude common AppData paths to reduce false positives.