Operation XENOFISCAL - Public USOShared Directory HTA Execution
Detects mshta executing any HTA file originating from the anomalous C:\Users\Public\USOShared-* path, as observed in Operation XENOFISCAL.
Microsoft Sentinel (KQL)
Detects mshta executing any HTA file originating from the anomalous C:\Users\Public\USOShared-* path, as observed in Operation XENOFISCAL.
Already have an account?