BlackBeard Malware Persistence via Startup Folder
Detects the creation of the 'Oregon.wdlp' file in the Windows Startup folder, which is a known secondary persistence mechanism used by the BlackBeard malware, linked to the Boggy Serpens threat group.
Microsoft Sentinel (KQL)
