KNTRAT masqueraded conhost.exe in LocalAppData Microsoft Conhost path
Detects execution or modification of conhost.exe from within a non-standard user-profile path (Microsoft\Conhost), which may indicate an attempt to masquerade or use renamed/relocated utilities.
Microsoft Sentinel (KQL)
