Operation XENOFISCAL - USOShared folder created by Explorer

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•1

Detects if the malicious USOShared-* public folder is created manually via explorer.exe, indicating interactive attacker staging. This specific pattern targets a folder named 'USOShared-' followed by alphanumeric characters and numbers within the C:\Users\Public directory.