UAC-0184 Suspicious Execution From User Profile
Detects Plane9 or Cluster-Overlay style execution from AppData or other user-writable staging paths, which is indicative of malware associated with the UAC-0184 threat actor.
Microsoft Sentinel (KQL)
Detects Plane9 or Cluster-Overlay style execution from AppData or other user-writable staging paths, which is indicative of malware associated with the UAC-0184 threat actor.
Already have an account?