CRESCENTHARVEST - Data Staging Artifacts
Detects the creation of files in specific staging directories used by the CRESCENTHARVEST malware for collecting keylogs, browser data, and Telegram sessions before exfiltration. The rule specifically looks for 'daT.txt' in 'spool\Drivers\color', and any file creation within '\Windows\Temp\sysdriver\' or '\Windows\Temp\tdata\'.
Microsoft Sentinel (KQL)
