Ousaban Payload Dropped to Masqueraded Path C:\SysMain_5874288
Detects file creation or write operations involving file paths containing the string 'SysMain_5874288'. This pattern is often associated with adversary attempts to drop, stage, or modify files using names designed to masquerade as legitimate system components or services, potentially to maintain persistence or evade detection.
Cortex XDR
