MeshCentral Agent Executed from Temporary or PeopleSoft Paths
Detects a MeshCentral agent launched from temporary directories or Oracle PeopleSoft application paths. This activity is often associated with remote access software used by adversaries.
Microsoft Sentinel (KQL)
