StrikeShark Campaign - SystemSettings.exe Copied to Staging Directory
Detects when 'SystemSettings.exe' is copied from its legitimate location to common staging directories like ProgramData, AppData, Temp, or Public. This activity is often observed in campaigns like StrikeShark as an early indicator before sideloading, providing an opportunity for earlier detection.
Microsoft Sentinel (KQL)
