AppDomain Hijacking Config Creation (Nimbus Manticore)
This rule detects the creation of specific configuration files (`setup.exe.config` or `updateconfig.xml`) that are associated with AppDomain Hijacking techniques used by the Nimbus Manticore threat actor. This activity indicates an attempt to manipulate application configuration to execute malicious code.
Microsoft Sentinel (KQL)
