MarkiRAT svehost.exe masquerade dropped in Public AppData\Windows
Detects the creation or presence of a file named 'svehost.exe' (a common typo-squat for 'svchost.exe') within the 'C:\Users\Public\AppData\Windows' directory. This behavior is indicative of an adversary attempting to masquerade a malicious executable by mimicking a legitimate Windows service process name and placing it in a non-standard, often-abused location.
Microsoft Sentinel (KQL)
