Masquerading Filenames (WindowsExplorerSupport/AdobeReader_Update/SystemCheck/lirMkvpf) with Signature Mismatch or Non-Standard Path
Detects execution of processes using filenames associated with the SMOKE#SCREEN campaign's masquerading payloads that either run from non-standard paths or lack a valid code-signing signature, indicating potential dropper or loader activity.
Cortex XDR
