HackTool - PurpleSharp Execution
Detects the execution of the PurpleSharp adversary simulation tool by looking for specific image paths, original filenames, or command-line arguments associated with the tool. This rule helps identify when an adversary simulation or red team exercise involving PurpleSharp is being conducted on a system.
Sigma
