Chaos Ransomware - GoodSync Data Exfiltration
Detects the use of GoodSync command-line tools for data exfiltration, a TTP associated with the Chaos ransomware group. The rule looks for suspicious command-line patterns, including masquerading as wininit.exe.
Microsoft Sentinel (KQL)
