Suspicious File Creation in Fake Recycle Bin Folder
Detects file write events from or to a fake Recycle.Bin folder, which is often used by malware as a staging directory. Adversaries may create folders with names similar to legitimate system directories (e.g., "RECYCLERS.BIN" instead of "RECYCLER.BIN") to hide their malicious files and evade detection.
Sigma
