Potential Renamed LOLBIN or Trusted Tool Execution
Detects executables whose Original File Name metadata differs from the actual filename on disk, which may indicate renamed Living-off-the-Land Binaries (LOLBINs) or attacker tools attempting to evade security controls. The rule specifically looks for a predefined list of known LOLBINs and trusted tools.
Microsoft Sentinel (KQL)
