System File Execution Location Anomaly
Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location. This can indicate an attempt by an adversary to masquerade malicious executables as legitimate system processes to evade detection.
Sigma
