GreenPlasma CTF AsmListCache Symlink Creation

Elgonad .@elgonad

•updated May 14, 2026•3•0•262

Detects the creation of an NT Object Manager symbolic link pointing to CTF.AsmListCache.FMPWinlogon paths, indicative of GreenPlasma Stage 1. This activity is captured via Windows Security Event 4663 (Object Access) and specifically filters for 'SymbolicLinkObject' creation where the object name contains 'CTF.AsmListCache.FMPWinlogon'.