Catching APT29 staging malware in 197k+ Sysmon events

The detection rule I built.