Cryptojacking via ScreenConnect - RuntimeHost Cache Drop
Detects malware copying itself as RuntimeHost.exe into a localized cache directory (D3F4E2A1) while ScreenConnect.ClientService.exe is running, indicating potential cryptojacking activity.
Microsoft Sentinel (KQL)
