Fake RuntimeBroker.exe GPU miner using Ravencoin wallet bc1q9a59...
Detects instances of 'RuntimeBroker.exe' executing from a directory other than the standard Windows System32 location, specifically when the command line includes a known cryptocurrency wallet address string. This behavior is indicative of potential masquerading or malicious activity where a legitimate Windows system binary name is abused to execute unauthorized commands or facilitate cryptocurrency-related tasks.
Microsoft Sentinel (KQL)
