Creation of bootTel.dat in Root Directory
Detects the creation of a file named 'bootTel.dat' directly in the root of the C: drive. This file name is historically associated with various malware families and potentially unwanted programs, and its creation in a system-protected directory root is often indicative of persistence mechanisms or suspicious stage-one dropper activity.
Microsoft Sentinel (KQL)
