Java Execution from ProgramData with -jar Flag
Detects the execution of the Java runtime (javaw.exe) from the C:\ProgramData\ directory with the -jar flag. This behavior is indicative of malware like Nimbus RAT, which bundles its own OpenJDK runtime to evade detection and bypass missing Java dependencies on the target host.
Microsoft Sentinel (KQL)
