Suspicious Process Execution with SYSTEM in Command Line
Detects suspicious process executions where 'ctfmon.exe' or 'cloudfiles.exe' are initiated by a non-SYSTEM user but contain 'SYSTEM' in their command line. This could indicate an attempt to impersonate or escalate privileges, potentially by manipulating process arguments to mimic system processes.
Microsoft Sentinel (KQL)
