Microsoft Workflow Compiler Execution (419dbf2b-8a9b-4bea-bf99-7544b050ec8d)

Detects invocation of Microsoft Workflow Compiler, which may permit the execution of arbitrary unsigned code.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Trusted Developer Utilities Proxy Execution - T1127 (ff25900d-76d5-449b-a351-8824e62fc81b)	Attack Pattern	Microsoft Workflow Compiler Execution (419dbf2b-8a9b-4bea-bf99-7544b050ec8d)	Sigma-Rules	1
System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4)	Attack Pattern	Microsoft Workflow Compiler Execution (419dbf2b-8a9b-4bea-bf99-7544b050ec8d)	Sigma-Rules	1