DeviceManager single-instance check: wmic process query + mutex creation from non-standard Python path
Detects a wmic process query followed by Windows Mutex creation, both initiated by python.exe/pythonw.exe running from a non-standard installation path, within a 5-minute window, consistent with DeviceManager's single-instance enforcement check.
Microsoft Sentinel (KQL)
