TinyRCT PerfWatson2.exe Executing from AppData\Local (CL-STA-1062)
Detects execution of the TinyRCT backdoor by monitoring for suspicious instances of 'PerfWatson2.exe' running from non-standard locations (outside of the expected Visual Studio program directories) and specific instances of 'chrome_setup.exe' originating from user download directories matching a known malicious SHA256 hash.
SentinelOne
