Rare Process Path

Identifies when a process is running from a rare path. This could indicate malicious or unexpected activity as attacks often try to use common process names running from non-standard locations