LOLBAS - Various LOLBAS Suspicious Network Connections (Sign of possible Ingress tool download)
This detection looks for various LOLBAS Processes that have download capabilities but are often seen rarely making network connections. They can be identified from the LOLBAS Project: https://lolbas-project.github.io/#/download Seen in various campaigns including recent clickfix activity
Microsoft Sentinel (KQL)
