PlugX process injection followed by rapid file drop and execution (initial foothold staging)
Detects PlugX-style initial-foothold staging: process injection followed within minutes by a dropped file that is then executed, excluding known-benign AV/EDR/updater injectors and targets.
Microsoft Sentinel (KQL)
