Detects file creation events with filename patterns used by CrackMapExec.
Read the full analysis on IntelFusions