TinyRCT PerfWatson2.exe Masquerading as Visual Studio Telemetry in AppData\Local
Detects the execution of 'PerfWatson2.exe' from within the user's AppData directory. This behavior is often associated with potential masquerading attempts, as legitimate instances of this file typically reside in system directories or specific application folders. The rule includes an exclusion for Microsoft Visual Studio related paths to reduce noise.
Splunk (SPL)
