LOLBin Copied as DLLs (TAX#TRIDENT)
Detects file execution where curl.exe or bitsadmin.exe are copied to a public document folder and renamed to DLL extensions (like winhttp.dll or wininet.dll) to evade detection. This activity is associated with the TAX#TRIDENT campaign.
Microsoft Sentinel (KQL)
