NirSoft credential harvesting toolkit staged in user Music folder

This rule detects the execution of known NirSoft credential recovery utilities, such as WebBrowserPassView, ChromePass, and others, when they are located within a specific 'music/mimik/' directory structure, which is indicative of credential harvesting activities staged by an adversary.