AI Brands as Bait - Suspicious Archive Drop then Installer Exec
Detects a .zip or .rar archive being dropped in a downloads folder, followed immediately (within 10 minutes) by the execution of a suspicious installer executable from that same path. The installer executable names are indicative of fake AI-related software (e.g., deepseek, gpt, kimi). This pattern suggests a social engineering attack where users are tricked into downloading and executing malicious software disguised as legitimate AI applications.
Microsoft Sentinel (KQL)
