XWorm 6.0 stealer plugin DLL loaded into RegSvcs.exe with credential store acces
Detects the correlation between the loading of known stealer plugin DLLs outside of standard application paths and subsequent process activity accessing credential stores, sensitive files, or executing wireless key recovery commands.
Microsoft Sentinel (KQL)
