Multiple Suspicious Files Dropped in Common User Directories

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•1

This rule detects when two or more files with suspicious names (e.g., 'update.exe', 'temp.exe', 'setup.exe') are created within a short timeframe (1 hour) in common user-writable directories such as 'Temp', 'AppData', 'Downloads', or 'Public'. This pattern can indicate the dropping of malicious payloads or staging of files by an adversary.