System File Execution Location Anomaly — Detection Rule

Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location.