CTFMON Symlink and CloudFiles Activity (GreenPlasma Exploit)
Detects ctfmon.exe calling NtCreateSymbolicLinkObject or loading cldapi.dll, which indicates the initial stages of the GreenPlasma exploit. This behavior is indicative of process injection or privilege escalation attempts.
Cortex XDR
