Executable Launched from User-Writable Directory
Detects the execution of processes from common user-writable directories such as Desktop, Downloads, AppData, Documents, and the Public folder. Adversaries often place and execute malicious payloads in these locations to evade detection and leverage user permissions. This rule helps identify potentially unauthorized or malicious software execution.
CQL
