TuglaInsaatci Dropper Self-Copy to AppData\Roaming with Hidden Attribute
This rule detects the creation or modification of executable files (.exe) within the 'AppData\Roaming' directory, excluding common legitimate application subfolders (Microsoft, Adobe, Mozilla, Skype, Notepad++). The detection is further refined by correlating these file events with processes that have specific version information (FileDescription, OriginalFileName, or ProductName) matching 'TuglaInsaatci' or 'oacY.exe'. This pattern is indicative of potential malware or unwanted applications attempting to establish persistence or execute from user-specific application data folders.
Microsoft Sentinel (KQL)
