Suspicious Process Start Locations
This rule detects the creation of processes from unusual and potentially suspicious locations on a Windows system. Specifically, it looks for executables being run from the 'RECYCLER' directory, 'SystemVolumeInformation' directory, or various subdirectories within 'C:\Windows\' that are not typically used for executable storage, such as 'Tasks', 'debug', 'fonts', 'help', 'drivers', 'addins', and 'cursors'. Adversaries often use these locations to hide malicious executables and evade detection.
Sigma
