Suspicious File Creation by Browser or Office Application

Luís Marques@remotecodeexecution

•updated today•0•0•0

(Part 1 of a Correlation) Detects the creation of a potentially executable or script file by a browser or Microsoft Office application. This rule is intended to be used in a correlation with a subsequent process execution.