PowerShell Script Execution from Public User Directory
This rule detects the execution of PowerShell scripts where the script path explicitly includes or references the "C:\Users\Public" directory. This directory is often used by adversaries to store and execute malicious scripts due to its default write permissions for all users, making it a common location for staging and executing payloads.
Sigma
