SecurityHealthSetup.exe from Non-Standard Paths
Detects the execution of 'SecurityHealthSetup.exe' from non-standard or suspicious directories such as 'Intel', 'Downloads', or 'Temp'. This executable is typically associated with Windows Security Health and should reside in system directories. Execution from other locations may indicate an attempt to masquerade malicious activity or defense evasion.
Microsoft Sentinel (KQL)
