Advanced Path Evasion via RtlDosPathNameToNtPathName
Detects scripts or commands that directly reference 'RtlDosPathNameToNtPathName' in their command line. This function can be used by adversaries for NT path evasion, a technique to manipulate how the operating system resolves file paths, potentially leading to execution of malicious files or bypassing security controls. The detection is based on the presence of this specific function name in process command lines.
Microsoft Sentinel (KQL)
