YobaDropper wmpdmc.exe copy and wmpdui.dll sideload staging in ProgramData
Detects the staging of wmpdmc.exe and wmpdui.dll together within a ProgramData folder, as well as subsequent scheduled task creation or execution of wmpdmc.exe from ProgramData associated with the Yoba campaign.
Microsoft Sentinel (KQL)
