Execution via WorkFolders.exe Proxying control.exe
Detects the execution of 'control.exe' as a child process of 'WorkFolders.exe', specifically when 'control.exe' is not launched from its default system directory. This behavior can indicate an attempt to bypass security defenses by proxying execution through a trusted Windows binary.
Sigma
