Crypto24 - Keylogger Log File Creation
Detects the creation of keylogger output files by the WinMainSvc component, which is associated with the Crypto24 ransomware group. The keylogger runs as a service via svchost.exe and creates log files in the C:\Windows\tmp\ directory with a specific naming pattern.
Microsoft Sentinel (KQL)
