Execution of cracked-software, game-cheat, or pirated-tool lure file
Detects the execution of executable files from user-specific directories (Downloads, Desktop, Temp) that match common naming patterns associated with illicit software, such as cracks, keygens, or pirated tools. This is often an indicator of users attempting to run unauthorized software, which may carry secondary malware.
Microsoft Sentinel (KQL)
