TinyRCT Sandbox Evasion: PerfWatson2.exe Executing Outside LOCALAPPDATA
Detects execution of the process 'PerfWatson2.exe' (associated with TinyRCT malware) from file paths other than the expected %LOCALAPPDATA% directory.
Microsoft Sentinel (KQL)
Detects execution of the process 'PerfWatson2.exe' (associated with TinyRCT malware) from file paths other than the expected %LOCALAPPDATA% directory.
Already have an account?