IMDS Abused: Hunting Rare Behaviors to Uncover Exploits

When common processes start asking the wrong questions...