Lazarus System Binary Masquerading — Detection Rule
Detects binaries used by the Lazarus group which use system names but are executed and launched from non-default location
Detects binaries used by the Lazarus group which use system names but are executed and launched from non-default location