Operation XENOFISCAL - Run Key Edgre pointing to Public Folder
This rule detects the creation or modification of a registry run key named "Edgre" where the associated value data points to the `C:\Users\Public\` directory. This behavior is associated with the Operation XENOFISCAL campaign, specifically for establishing persistence by placing malicious payloads in a publicly accessible user directory.
Microsoft Sentinel (KQL)
