APT28 - GUID-Named Script Cluster Dropped
Detects the creation of multiple files with the same GUID-like name but different extensions (VBS, BAT, CMD, HTM, XHTML) within a short time frame in the user profile directory. This pattern is characteristic of the APT28 "Operation MacroMaze" dropper behavior.
Microsoft Sentinel (KQL)
