Operation XENOFISCAL - XenoUpdateManager Triggering Network Call
Detects process executions originating from the XenoUpdateManager task that immediately initiate outbound network connections. This behavior is associated with Operation XENOFISCAL, where the SideCopy threat group deploys XenoRAT.
Microsoft Sentinel (KQL)
