VT detections aren't representative of security vendors' full detection posture.
But, because this had poor coverage (and only @cyb3rops had helpful context on the XOML's mem process write), I'm sharing my Aug 2018 #DailyWorkflow rules if they help: gist.github.com/itsreallynic…
[4/4]