Cryptojacking - D3F4E2A1 Cache Staging
Detects the malware copying itself into the localized cache directory under the hardcoded campaign ID D3F4E2A1, specifically looking for 'RuntimeHost.exe' being created in that path.
Microsoft Sentinel (KQL)
Detects the malware copying itself into the localized cache directory under the hardcoded campaign ID D3F4E2A1, specifically looking for 'RuntimeHost.exe' being created in that path.
Already have an account?