Security Tool Impersonation via MsMpEng, SenseNdr, csfalconservice, or CylanceSvc from Non-Standard Path
This rule detects common security product executables (MsMpEng.exe, SenseNdr.exe, csfalconservice.exe, CylanceSvc.exe) that are running from file paths inconsistent with their legitimate installation directories. This behavior is indicative of an adversary attempting to masquerade as trusted security software to evade detection or achieve persistence.
Microsoft Sentinel (KQL)
