Suspicious Execution from ScreenConnect Temporary Directory
Detects the execution of an executable from the temporary ScreenConnect application directory. This behavior has been observed in recent malvertising campaigns where rogue ScreenConnect instances are used to deploy and execute multi-stage crypters (e.g., FatMalloc/crypteds.exe) from this directory, initiating ransomware and BYOVD payloads.
Microsoft Sentinel (KQL)
