Prinz Eugen servertool.exe executed from user Music or OneDrive folders
Detects the execution of a process named 'servertool.exe' specifically when it originates from a user's OneDrive Music folder or a generic Music folder within the user profile. This could indicate an attempt to masquerade malicious activity by placing an executable in an unusual, typically benign location.
Microsoft Sentinel (KQL)
