LoaderClient/WeedHack Backdoor Masquerading as RuntimeBroker/Telemetry in AppData\Roaming
Detects the creation or execution of files named 'RuntimeBroker.exe', 'Telemetry.exe', or 'WindowsRunetimeBroker.exe' within the AppData folders. These filenames are commonly abused by adversaries to masquerade as legitimate system processes to evade detection.
Microsoft Sentinel (KQL)
