Downloads Directory File Activity Monitoring
Detects file write events occurring within users’ Downloads directories on Windows endpoints. The detection monitors file creation or write activity under C:\Users\<Username>\Downloads\ and captures relevant details, including hostname, username, file name, file path, company name, SHA-256 hash, and the originating process name. This detection helps identify potentially suspicious downloads, unauthorized file transfers, and files that may require further investigation.
CQL
