Suspicious Number of Executable File Creations in Setup/Install/Bin Folders

Ankit Mehta@Secvyn

•updated Jun 13, 2026•0•0•0

This rule detects an unusually high number of executable (.exe or .msi) file creations within common installation or binary folders (containing 'setup', 'install', or 'bin' in their path) by a single process within a one-hour window. This behavior could indicate the staging or unpacking of malicious software, or a legitimate but potentially suspicious installation activity.