Suspicious Executable Execution from Temp Directory with INI Configuration
This rule detects the execution of a suspicious, specifically named executable (ogftogcyiblzjccmcbnw.exe) originating from a temporary folder, or the creation/access of a related configuration file (kojuyn.ini) within the same temp directory. This pattern is consistent with the delivery and execution of malicious tools like AsyncRAT or similar threats that often use obfuscated filenames and localized configuration files within temporary user paths.
Microsoft Sentinel (KQL)
