Suspicious Binaries and Scripts Created in Windows Public Folder
Detects the creation of files with suspicious extensions (e.g., .bat, .dll, .exe, .hta, .js, .ps1, .vbe, .vbs) within the Windows Public user folder. This activity can indicate an adversary staging malicious scripts or binaries in a location accessible to all users, potentially for execution or further distribution.
Sigma
