Diagcab File Creation
Detects the creation of '.diagcab' files, which can be used by legitimate installers but also by adversaries for exploitation or data collection. The rule suggests reviewing the filename and its location for further investigation.
Sigma
