UAC-0184 Plane9 OpenVR Sideload
Detects the creation of specific files associated with the UAC-0184 threat group, often used in DLL sideloading scenarios. The rule looks for the presence of 'cluster-overlay64.exe', 'plane9engine.exe', 'plane9engine.dll', 'openvr_api.dll', 'kernel-diag.lib', and 'filter.bin' in common temporary or user data directories. It triggers if three or more of these files are found within an hour, or if 'kernel-diag.lib' or 'filter.bin' are present.
Microsoft Sentinel (KQL)
