GRAT Suspicious File Execution
Detects the execution of specific file names and directory combinations used by the GRAT malware (Cyber Isnaad Front) to masquerade as legitimate tools before deploying ransomware or wiper modules. Specifically looks for 'Checker.exe.exe', 'WindowsUpdater.exe' in 'C:\ProgramData\', and 'SpellChecker.exe' in '\AppData\Roaming\Microsoft\Spelling\'.
Microsoft Sentinel (KQL)
