CRESCENTHARVEST - Sideloading via Google Software Reporter Tool from Suspicious Directories
Detects the execution of the deprecated Google 'software_reporter_tool.exe' from suspicious user-writable directories. This technique is used by the CRESCENTHARVEST malware campaign to perform DLL sideloading using a signed, but deprecated, binary to evade defenses.
Microsoft Sentinel (KQL)
