CcmPwn exec/coerce usage against SCCM client (SCNotification.exe.config)
Detects suspicious command-line execution patterns involving 'ccmpwn', coercing features, or manipulation of Configuration Manager configuration files such as SCNotification.exe.config.
Splunk (SPL)
