Execution of Disguised Executable in ProgramData
Detects the execution of binaries hidden in the C:\ProgramData directory with a .log extension matching a specific random pattern used by threat actors. This technique is often used for defense evasion and masquerading.
Microsoft Sentinel (KQL)
