PoisonX Dropper Temporary File Creation
Detects the creation of temporary '.tmp' files starting with 'Hid' in the user's temporary directory, which is indicative of the PoisonX dropper deploying its driver. This behavior is associated with the initial stages of PoisonX malware execution.
Microsoft Sentinel (KQL)
