Operation XENOFISCAL - Public Folder Execution to Registry Key Drop
Detects a process launching from the USOShared or firefx public folders and subsequently modifying the registry. This activity is associated with the Operation XENOFISCAL campaign, which has been observed deploying the Xenorat RAT.
Microsoft Sentinel (KQL)
