Gryxa toolkit files staged in hidden WinRTCS and masquerading cache directories
Detects Gryxa staging behavior where files are written across 2 or more distinct toolkit directories (such as WinRTCS, WER .wucache, and Diagnosis .etlcache) within a 1-hour window on a single device.
Microsoft Sentinel (KQL)
