Publisher Attachment File Dropped In Suspicious Location

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•18

Detects the creation of files with the '.pub' extension (Microsoft Publisher documents) in suspicious or uncommon locations such as temporary directories or public user folders. This activity could indicate an attacker abusing Publisher documents for malicious purposes, potentially as part of defense evasion or initial access.