CloudFiles BlockedApps Registry Symlink
Detects registry key creation under CloudFiles\BlockedApps, indicative of the GreenPlasma exploit where attackers use a volatile registry symlink to hijack the CloudFiles policy engine. This technique can be used for privilege escalation.
Cortex XDR
