Malicious svchost.exe dropped in user Documents folder (N-central CVE-2026-18577)
Detects the creation of files named 'svchost.exe' within user Documents directories, excluding files located in 'C:\Windows\System32'. This rule identifies potential file masquerading, a tactic often used by adversaries to hide malicious binaries within legitimate system process names during post-exploitation activities.
Microsoft Sentinel (KQL)
