Suspicious .NET Executable in Windows Temp Staging Directory (Agrius)

Luís Marques@remotecodeexecution

•updated today•0•0•0

Detects .NET executables created in the Windows temp staging directory C:\windows\temp\s\, a known Agrius wiper deployment location.