TrustConnect Masquerading Binary Execution
Detects the execution of executables that masquerade as common collaboration tools (e.g., Teams, Zoom, Adobe) but have characteristics of the TrustConnect RAT. TrustConnect uses large (approx. 35MB) .NET Core single-file executables where the internal/original filename is a .dll, which is a mismatch from the .exe process name.
Microsoft Sentinel (KQL)
