Executable Launched from Temp Directory
This rule detects the execution of an executable (.exe) file from a user's temporary directory (AppData\Local\Temp). This behavior is often associated with malware or suspicious activity, as temporary directories are frequently used by adversaries for staging and executing payloads. The rule specifically excludes executables with 'setup' in their command line to reduce false positives from legitimate software installations.
CQL
