LotusLite SmartPrint File Staging (MustangPanda)
Detects the creation or renaming of the 'SmartPrintScreen.exe' file within the specific staging directory '\ProgramData\SmartPrint\' used by the LotusLite dropper. This activity indicates the staging of malicious files prior to execution.
Microsoft Sentinel (KQL)
