Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected Cache