Potentially Untrusted Executable Written to User Directories
Detects Windows Portable Executable (PE) files (.exe) written to common user profile directories, such as Desktop, Downloads, Documents, and other user profile folders that lack company name metadata. This activity may indicate potentially untrusted executables, dropped malware, or masquerading attempts in user-writable locations. The detection may also identify legitimate software, portable applications, development tools, and other benign files.
CQL
