Infostealer Dropped to AppData Local Temp 100000* Path (RedLine/Lumma)
Detects the creation or execution of executable files from within %APPDATA%\Local\Temp subdirectories starting with '100000', a path pattern frequently associated with the distribution and staging of infostealer malware such as RedLine and Lumma.
Sigma
