Process spawned from unusual directory

Detects executions of common utilities or build tools when those binaries are launched from suspicious default Windows directories. Attackers often place well-known system binaries beside malicious payloads or abuse proxy binaries from unexpected paths to evade defenses.

• Platform: Windows
• Severity: Medium
• MITRE Tactic: Defense Evasion
• MITRE Techniques: T1218

Back to all rules