GreenPlasma + MiniPlasma Detection / Nightmare-Eclipse CTFMON LPE Detection
This rule detects the creation of a 'SymbolicLinkValue' registry value within the 'CloudFiles' 'BlockedApps' registry key. This specific registry modification is associated with techniques designed to bypass security restrictions, specifically related to the abuse of symbolic links in the context of Windows CloudFiles/OneDrive mechanisms to achieve unauthorized file system access or privilege escalation.
Cortex XDR
