Deceptive GData Directory Staging by Mustang Panda
Detects the staging and installation of the G DATA Avk.exe sideloading set within the unexpected C:\Users\Public\GData\ directory, associated with a Mustang Panda PlugX campaign. This rule specifically looks for the creation of files named "Avk.exe", "Avk.dll", or "AVKTray.dat" in this suspicious public user directory.
Microsoft Sentinel (KQL)
