GraphWorm Persists through a Run Key
Detects the creation or modification of a Windows Registry Run key that points to an executable with names associated with GraphWorm or C2OverOneDrive malware, or an unusual OneDrive-themed binary located outside of legitimate OneDrive client paths. This rule specifically looks for registry events where the key name contains 'CurrentVersion\Run' and the data contains 'C2OverOneDrive', 'GraphWorm', 'OneDrive.*AppData', or 'config.dat'.
Cortex XDR
