CreateProcessWithLogonW notepad.exe launch under mismatched account (LegacyHive profile hive load)
Detects instances where notepad.exe is executed with a security context (AccountName) that differs from the initiating process's account (InitiatingProcessAccountName). This pattern is consistent with the LegacyHive technique, which utilizes CreateProcessWithLogonW to load a target user's registry hive by spawning a suspended process as that user.
Microsoft Sentinel (KQL)
