Fake Svchost Execution from msres Directory
Detects execution of svchost.exe from the non-standard \Windows\SysWOW64\msres\ folder. This behavior is associated with the ClientSetup/SyncFuture payload used in the TAX#TRIDENT campaign to maintain C2 sessions.
Microsoft Sentinel (KQL)
