Windows Vault Staging and Execution Activity
Detects potential staging and execution of files from the Microsoft Vault directory within AppData, often associated with adversary tooling or credential theft.
Microsoft Sentinel (KQL)
Detects potential staging and execution of files from the Microsoft Vault directory within AppData, often associated with adversary tooling or credential theft.
Already have an account?