All Detections

Suspicious .NET Executable in Windows Temp Staging Directory (Agrius)

avatar
Luís Marques@remotecodeexecution
updated Apr 2, 2026063

Detects .NET executables created in the Windows temp staging directory C:\windows\temp\s\, a known Agrius wiper deployment location.

Sigma