Deno installed by WinGet after fake software execution
This rule detects the installation of Deno via Windows Package Manager (winget.exe) when initiated by common scripting or installer processes (powershell.exe, cmd.exe, msiexec.exe). This activity is indicative of a potential attack where a fake application might have been executed, leading to the quiet setup of Deno, which can then be used as a Remote Access Trojan (RAT). The rule specifically looks for 'winget.exe' executing with 'install' and 'Deno' in its command line, initiated by the specified processes.
Microsoft Sentinel (KQL)
