Suspicious Execution from MIMICRAT ProgramData Staging Directory
Detects the execution of an executable from a subdirectory under %ProgramData% that matches the 'knz_' naming convention used by the MIMICRAT loader. MIMICRAT uses this directory to stage its Lua-based loader (zbuild.exe). The rule specifically looks for unsigned executables to reduce false positives.
Microsoft Sentinel (KQL)
