Suspicious File Creation In Uncommon AppData Folder

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects the creation of suspicious files and folders inside the user's AppData folder but not inside any of the common and well known directories (Local, Romaing, LocalLow). This method could be used as a method to bypass detection who exclude the AppData folder in fear of FPs