syscheck_entry_added (?i)espionage.*\.b64 Base64 file created in Espionage directory - Possible Data Exfiltration T1027 T1074 data_exfiltration,lolbin 550 (?i).*CurrentVersion\\Run.* Registry persistence key modified - Possible malware persistence T1547 persistence 502 cmd\.exe Suspicious cmd.exe execution detected T1059 execution syscheck (?i).*\\Temp\\.*\.exe Executable dropped in Temp directory - Possible malware staging T1105 ingress_tool_transfer