generic indicator to identify common commands not run from default locations
duqu ioc
ponmocop ioc