Suspicious Calculator Usage
Detects suspicious use of 'calc.exe' with command line parameters or when executed from a non-standard directory. This behavior is often associated with proof-of-concept exploits, malware, or detection evasion techniques where 'calc.exe' is used to test execution or as a decoy.
Sigma
