Sysinternals Tools Execution from AppX Package
Detects the execution of Sysinternals tools that have been installed via an AppX package. This method of deployment might be used by attackers to bypass detection mechanisms that rely on monitoring standard system paths for these tools.
Sigma
