Operation XENOFISCAL - Shellcode VMXX Files Dropped in Firefx Dir
High fidelity detection combining the specific firefx-* staging directory pattern with the .vmxx shellcode file extensions, indicative of Operation XENOFISCAL activity. This rule identifies the creation or modification of files with '.vmxx' extension or specific filenames ('ayui.vmxx', 'ayhui.vmxx') within a suspicious 'C:\Users\Public\firefx-[a-f0-9]+-[0-9]+\' directory pattern, which is known to be used by the SideCopy threat group.
Microsoft Sentinel (KQL)
