Masquerading svchost.exe process executing from %TEMP% directory
Detects instances where a process named 'svchost.exe' is executed from common temporary file paths, which is characteristic of malware attempting to masquerade as the legitimate Windows Service Host process.
Microsoft Sentinel (KQL)
