Payouts King - Process Masquerading as Legitimate System or IT Tool
This rule identifies processes masquerading as common Windows system binaries (e.g., svchost.exe, lsass.exe) by executing from non-standard, suspicious file paths like temporary directories or user profiles instead of legitimate system directories (e.g., C:\Windows\System32).
Microsoft Sentinel (KQL)
