YobaDropper wmpdmc.exe staged in ProgramData\WMProcess with wmpdui.dll sideload
Detects the Yoba campaign behavior involving the staging of wmpdmc.exe along with wmpdui.dll or ampdui.dll in the ProgramData\WMProcess directory, followed by execution or invocation via scheduled tasks.
Microsoft Sentinel (KQL)
