MATCHBOIL PlannerAssistantManager/RegularExpressionExplorer launched with -auto/
Detects the execution of MATCHBOIL malware variants (PlannerAssistantManager.exe or RegularExpressionExplorer.exe) using specific command-line arguments (-auto, -plans, -renew) which trigger C&C logic.
Microsoft Sentinel (KQL)
