Suspicious Process Execution with SYSTEM in Command Line
Detects suspicious process executions where 'ctfmon.exe' or 'cloudfiles.exe' are initiated by a non-SYSTEM user but contain 'SYSTEM' in their command line. This could indicate an attempt to impersonate or escalate privileges, potentially by manipulating process arguments or environment variables to execute code as SYSTEM.
Microsoft Sentinel (KQL)
