Temporary Loader Installing Under AppData Local Programs

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•1•0•13

This rule detects executable files being created or launched within the 'AppData\Local\Programs' directory by a temporary-stage process. This behavior is often indicative of malware attempting to establish persistence or execute from a user-specific location, leveraging temporary directories for initial execution or staging.