Fake AV rogueware WinProtector scan popup bundled with Sality
Detects the execution of known WinProtector rogueware binaries. These files often present fake 'threat detected' popups to coerce users into paying for fraudulent software and are frequently bundled with other malware, such as Sality.
Microsoft Sentinel (KQL)
