Face-swap/deepfake application execution detected
Detects execution of face-swapping or deepfake software, excluding known legitimate virtual-background/video-filter tools, consistent with PurpleDelta operators disguising their identity during video interviews.
Microsoft Sentinel (KQL)

