CornFlake Security Posture Sweep: Correlated Burst of svchost32.exe Registry Enumeration (Defender/RDP/UAC/Office MRU)
Detects a correlated burst of registry enumeration by the impersonating process svchost32.exe touching multiple security-posture-relevant registry locations (Defender exclusions, RDP history, Office MRU, UAC level) within a short window, consistent with CornFlake reconnaissance.
Cortex XDR
