TA4922 Malicious Payload Execution from Temporary Directories

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•3

Detects the execution of various suspicious file types (executable, scripts, shortcuts) from common Windows temporary directories (AppData\Local\Temp and Windows\Temp). The rule excludes common installers and binaries signed by reputable software publishers to reduce noise.