NetProvider execution from non-standard path or alongside videoconferencing app
Detects execution of the NetProvider network-monitoring utility from a non-standard install path or in close time proximity to an active videoconferencing session, consistent with PurpleDelta operator self-monitoring of network traffic during interviews.
Microsoft Sentinel (KQL)
