Update and rename proc_creation_win_winscp_portable.yml to proc_creation_win_winscp_portable_execution.yml

Author: nasbench

…on/proc_creation_win_winscp_portable.yml …eation_win_winscp_portable_execution.ymlrules-threat-hunting/windows/process_creation/proc_creation_win_winscp_portable.yml renamed to rules-threat-hunting/windows/process_creation/proc_creation_win_winscp_portable_execution.yml rules-threat-hunting/windows/process_creation/proc_creation_win_winscp_portable.yml renamed to rules-threat-hunting/windows/process_creation/proc_creation_win_winscp_portable_execution.yml

@@ -1,11 +1,11 @@
-title: Winscp Launch From Uncommon Folder
+title: Winscp Execution From Non Standard Folder
 id: 7674f8ef-7141-4cf0-a311-ee359264c64c
 status: experimental
-description: Use Winscp from an uncommon folder
+description: Detects the execution of Winscp from an a non standard folder. This could indicate the execution of Winscp portable.
 references:
     - https://blogs.blackberry.com/en/2024/07/akira-ransomware-targets-the-latam-airline-industry
 author: frack113
-date: 2024-07-30
+date: 2025-10-12
 tags:
     - attack.exfiltration
     - attack.t1048
@@ -17,9 +17,9 @@ detection:
     selection:
         - Image|endswith: '\WinSCP.exe'
         - OriginalFileName: 'winscp.exe'
-    filter:
-        Image|contains: ':\Program Files (x86)\WinSCP\'
-    condition: selection and not filter
+    filter_main_location:
+        Image|startswith: 'C:\Program Files (x86)\WinSCP\'
+    condition: selection and not 1 of filter_main_*
 falsepositives:
     - Unknown
 level: medium