I analyzed 196k+ Sysmon events and found APT29 staging malware in Temp. Here is my detection logic.