What do you usually use for a detection rule for a win32 application that installs using user install behavior into the user's profile? I tried looking for a file using %localappdata%, but even though the application was installed in the currently logged in user's profile, Intune resolved %localappdata% to the system profile (C:\Windows\system32\config\systemprofile).