Operation XENOFISCAL - Firefx Directory Shellcode Exec
Detects any process executing files with .vmxx extensions residing within the anomalous firefx- directories, which is indicative of activity related to Operation XENOFISCAL, specifically the deployment of persistent XenorRAT by the SideCopy threat group.
Microsoft Sentinel (KQL)
