Directory enumeration followed by file staging in Downloads or Roaming profile

ills3c Intel&Coffee@Ills3C

•updated yesterday•0•0•1

Detects correlation between directory or path discovery commands (such as net use, net view, Get-ChildItem, OneDrive, robocopy) and significant file staging activities involving document or archive files created within Downloads or AppData\Roaming subdirectories on the same device within a 1-hour window.