Suspicious Executable in Downloads Folder Lacking Metadata
This rule detects executable files created in the Downloads folder that lack common file metadata fields such as FileVersion, Description, Product, or Company. This characteristic is often observed in executables generated by tools like py2exe, which can be used by adversaries to package Python scripts into standalone executables, potentially for malicious purposes. The rule specifically looks for the absence of these fields (indicated by a '?' in the rule logic) in conjunction with the file being located in a user's Downloads directory.
Sigma
