Executable Launched from AppData Roaming

nomit vyas@xoxo

•updated Apr 30, 2026•4•0•69

This rule detects when an executable (.exe) is launched from the AppData\Roaming directory. This directory is often used by legitimate applications, but it is also a common location for malware to drop and execute itself. The rule excludes processes related to OneDrive and Teams to reduce false positives.