Malware in the recycle bin (Normalized Process Events)
'Identifies malware that has been hidden in the recycle bin. To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent)'
Microsoft Sentinel (KQL)
