Run key persistence referencing WpcMon.exe in AppData after WpcMon drop
Detects a sequence where WpcMon.exe is created or modified within a user AppData Local Microsoft WpcMon path, followed by a Registry Run key value creation pointing to it within 1 hour on the same device, associated with the CMS.exe compromise campaign.
Microsoft Sentinel (KQL)
