T1036.005: Masquerading as Windows .NET AppLaunch.exe
Detects the execution of a process named 'AppLaunch.exe' from a directory other than the standard .NET Framework installation paths. Adversaries may masquerade as this legitimate .NET binary to evade detection, as it is a trusted system utility.
Sigma
