SloppyLemming BurrowShell Persistence via OneDrive Run Key
Detects the creation of a registry run key named 'OneDrive' that points to an executable located within the user's AppData ClickOnce cache directory. This is a specific persistence technique used by the SloppyLemming actor to execute the BurrowShell loader.
Microsoft Sentinel (KQL)
