Blind Eagle wchelper.exe Surveillance Module Execution
Detects the execution of wchelper.exe in conjunction with the reference of a 'wch.zip' file. This behavior is associated with surveillance modules attributed to the Blind Eagle (APT-C-36) threat group, which typically function as spyware to exfiltrate system data.
Microsoft Sentinel (KQL)
