Dohdoor Suspicious Program Run From ProgramData
Detects a Windows program being run from a shared folder instead of its normal location, with an unusual command added. This can be a sign that a clean program was copied and used to run a harmful file.
Sigma
