Game Client Drops an Executable into a User Profile
Detects a game launcher writing a new executable beneath AppData or the user profile, which is unusual for signed platform updates and may represent RokRAT or BirdCall staging. This rule specifically looks for file creation events where the file is an executable (.exe), the path is within a user's AppData, Documents, or Downloads folder, and the creating process is identified as a game, launcher, update, or patch executable.
Cortex XDR
