NightLedger File Staging Operations via AppVShNotify.exe Host Process
Detects file staging activity by AppVShNotify.exe, the legitimate App-V binary abused by NightLedger via DLL search-order hijacking. NightLedger's C2 command dispatcher supports Command ID 20 (download file), Command ID 27 (copy file), and Command ID 62 (delete file), which manifest as file create/delete activity performed by this hijacked host process. To reduce noise from genuine App-V client operation, the rule fires either when AppVShNotify.exe is observed loading the rogue SspiCli.dll (the sideloaded hijack DLL) or when the process performs file create/delete activity against paths outside the standard App-V cache/staging directories.
Microsoft Sentinel (KQL)
