You need to start using Windows' overlooked package manager.
As attackers hide longer and deeper, behavior-first detection becomes the only reliable way to expose them.