Legitimate Application Dropping Executable
This rule detects when specific legitimate Windows applications, including Microsoft Office programs, LOLBINs (Living Off the Land Binaries), and other common executables, create new executable files (.exe, .dll, .ocx) on disk. This behavior is often indicative of malicious activity, such as malware dropping payloads or using trusted processes to evade detection.
Sigma
