TOKYOCORE Lateral Movement via ADMIN$/IPC$ Copying fsociety.exe
Detects the lateral movement behavior of the TOKYOCORE ransomware, which involves copying the 'fsociety.exe' file to remote hosts using administrative shares (ADMIN$ or IPC$) or specifically targeting the '\Windows\Temp\' directory.
Cortex XDR
