Feels kind of weird that Windows Defender doesn't have something that catches this kind of behaviour? I mean if you have the Defender settings jacked up you're not going to be able to run executables anyway without a bunch of mucking around which should at least stop accidental running, but feels like some heuristics to stop these kinds of stealers should be a high priority for the Defender team. Not sure how you'd go about it though?