Fake Google Meet MSI dropping GoogleMeet.exe in Agent folder via msiexec
Detects the installation of a Google Meet-named MSI package via msiexec.exe from user-writable paths or non-Google URLs, correlated with the creation of a GoogleMeet.exe binary in the Google Meet Agent directory.
Microsoft Sentinel (KQL)

