mhm.dll file manager module DPAPI decryption and archive collection
This rule detects suspicious activity associated with the Cavern Manticore threat group, specifically the loading of the 'mhm.dll' module followed by the creation of archive files (.zip, .rar, .7z) within one hour by the same process. This behavior is indicative of data staging for exfiltration, potentially involving DPAPI-protected data.
Microsoft Sentinel (KQL)
