CL-STA-1062 Malware Staging in ProgramData Masquerade Directories

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•3

Detects adversary activity associated with CL-STA-1062, specifically the use of archive extraction tools to unpack content into hidden or masqueraded ProgramData directories (VMware, Microsoft, Intel). The rule also monitors for process execution and the creation of scheduled tasks that utilize these specific staging paths.