FlexibleFerret Suspicious Ad-hoc App Execution

Detects execution of ad-hoc signed applications from suspicious locations, used by FlexibleFerret credential harvesting.