Windows Network Connection From Program In Suspect Location — Detection Rule
The following analytic detects network connections from processes running out of suspicious Windows directories such as Recycle Bin, Public, PerfLogs, systemprofile, Fonts, IME, and Addins paths. This activity is significant because malware often executes from writable or unusual directories while communicating with external infrastructure. If confirmed malicious, the process may represent command-and-control, staging, or data exfiltration activity from a compromised endpoint.