Process spawned from unusual directory
Detects executions of common utilities or build tools when those binaries are launched from suspicious default Windows directories. Attackers often place well-known system binaries beside malicious payloads or abuse proxy binaries from unexpected paths to evade defenses.
- Plataforma: Windows
- Severidad: Medium
- Táctica MITRE: Evasión de defensas
- Técnicas MITRE: T1218