Masquerading system executable

Finds legitimate system32 or syswow64 executables being run under a different name and in a different location. The rule will require tuning for your environment. MITRE: Masquerading https://attack.mitre.org/techniques/T1036. Get a list of all processes run, except those run from system32 or SysWOW64.