CL-STA-1062 TinyRCT PerfWatson2.exe Masquerading in AppData\Local
Detects instances of PerfWatson2.exe executing from non-standard locations (outside of known Visual Studio directories) or matching known malicious file hashes/versions. This behavior is indicative of masquerading, where a malicious binary attempts to mimic legitimate Microsoft software.
Microsoft Sentinel (KQL)
