Process Executed from Downloads Folder - Windows [splunk-sysmon]

This use case detects the execution of executable files (.exe) that originate from the Downloads folder of any user profile on a system. This technique is commonly used by threat actors who leverage social engineering or phishing campaigns to trick users into downloading and executing malicious software, which can then be used for a variety of malicious purposes such as gaining unauthorized access, data exfiltration, or delivering additional payloads.