[WINDOWS-SECURITY] Parent process in the Downloads directory started a process

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SECURITY] Parent process in the Downloads directory started a process"; program:*Security*; event_id:4688; json_map:"event_id",".EventID"; json_map:"message",".Message"; content:!"
| 5c
| Foxit PDF Reader
| 5c
| "; content:!"
| 5c
| Microsoft Office
| 5c
| "; content:"
| 5c
| Downloads
| 5c
| "; nocase; content:".exe Process Command Line
| 3a
| "; nocase; pcre:"/Creator Process Name\: C\:\\Users\\[a-zA-Z_0-9]+\\Downloads/"; json_map:"src_ip",".xff"; threshold: type suppress, track by_src, count 5, seconds 3600; classtype:trojan-activity; sid:5013681; rev:2; metadata:deployment Server,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2023_08_01, updated_at 2026_08_05, mitre_tactic_id TA0002, mitre_technique_id T1204;)