Sigma Rules

DarkGate - Drop DarkGate Loader In C:\Temp Directory

Detects attackers attempting to save, decrypt and execute the DarkGate Loader in C:\temp folder.