Local staging of stolen browser credentials to ProgramData\log.txt
Detects the creation or modification of a file named 'log.txt' within a 'ProgramData' directory by the 'FortiEndpoint_Patch.exe' process. This pattern may indicate the diagnostic logging activity of the FortiEndpoint patch mechanism.
Microsoft Sentinel (KQL)
