Detects the execution of the "cloudflared" binary from a non standard location.
Read the full analysis on IntelFusions