clspack.exe signed binary executing from %AppData%\Microsoft path
Detects execution of 'clspack.exe' from within the user's AppData directory. This location is frequently used by adversaries to stage and execute malicious binaries to evade detection, as it is outside of typical system directories like System32 or SysWOW64 where trusted system binaries are expected.
Microsoft Sentinel (KQL)
