GIFTEDCROOK Persistent Host ID File Written to TEMP (oBKhrQLe1CKmO3RhHO)
Detects the creation of specific file names ('oBKhrQLe1CKmO3RhHO', 'logs.txt', 'ExitCode.txt', 'Key10.txt') within the user AppData Local Temp directory, which is indicative of staging or logging activity by potential malware.
Splunk (SPL)
