WT.exe Process Creation in ProgramData
Detects the creation of a process named 'wt.exe' within the 'ProgramData' directory, which is an unusual location for a legitimate executable and could indicate malicious activity. Exclusions are in place for common administrative tools and specific endpoint naming conventions to reduce false positives.
SentinelOne
