File Executed from INetCache [splunk-winevent]

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer). This use case detects when a file was executed from the C:\Users\<user>\AppData\Local\Microsoft\Windows\INetCache\IE folder.