Silent Rotor - Public Documents Staging Alternate (T1074.001)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•1

This rule specifically flags the creation of executable files (.exe) in the unusual C:\Users\Public\Documents\ path, which is often used by malware for staging purposes, as observed in Operation Silent Rotor. The detection looks for a specific naming convention of 6 alphanumeric characters followed by '.exe'.