Liushen decoy temp file creation during sandbox evasion routine

Subhankar H@Andrewsec57

•updated Jul 8, 2026•1•0•2

Detects the creation of temporary files in the root directory (C:\) following the naming convention 'temp_*.tmp'. This pattern is associated with the evasion or decoy-generation behavior observed in Liushen ransomware, used to check for environmental artifacts or test file system operations.