Legitimate Application Dropped Executable

SigmaHQ Detections@sigmaHQ

•updated Jul 1, 2026•0•0•0

Detects LOLBINs and applications that should not legitimately drop executable or executable-equivalent files to disk. This may indicate malware staging, process injection, or abuse of a trusted binary for payload delivery.