Operation DragonReturn Mixed Reality.exe Dropped into Windows Media Player Dir
Detects the creation of specific files ('Mixed Reality.exe' or 'nvdaHelperRemote.dll') within the 'C:\Program Files\Windows Media Player\' directory. This activity is a known technique used by the threat actor group associated with Operation DragonReturn (Silver Fox) to stage DLL sideloading, facilitating the persistence of malware such as DcRAT or XenoRAT.
Sigma
