Executable Files Created in Uncommon Locations

This analytic rule detects any executable file creation in uncommon locations like temproray folders. This could be an indication of a persistence or defese evasion attempt by an adversary.

Detection logic

Detection requirements

Platform: ESXi Linux macOS Network Devices Office Suite Windows
The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.
Log source product: ciscosecureendpoint crowdstrikefalconendpointprotection microsoftthreatprotection sentinelone trendmicroapexone trendmicroapexoneama vmwarecarbonblack
Log source service: carbonblackevents_cl ciscosecureendpoint_cl commonsecuritylog securityalert sentinelone_cl tmapexoneevent

Detection rules

Executable Files Created in Uncommon Locations

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules