🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e90337407e97c12f994d4d2a981a29516633c657f962ff94ba2c1f1ca22f4e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 310 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e90337407e97c12f994d4d2a981a29516633c657f962ff94ba2c1f1ca22f4e4
SHA3-384 hash: ef645c6ca6a5dad64ae720b99fbe0f5c371106e154a9ba5d1291fce62c06a24adbd925cd9b043f9869994396e7594a57
SHA1 hash: 2f66a30e88674a543df952a9462b86c9d1ffdf9e
MD5 hash: fd76bbd5a550246497adf3997a2701d4
humanhash: lima-lactose-beer-carolina
File name:PO_N0_98076.JS
Download: download sample
Signature Formbook
Create hunting rule
File size:3'126'093 bytes
First seen:2026-11-04 07:35:26 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:application/javascript
ssdeep 49152:TB6zg2cdyVY6hN2L5PGeklRvDvrTwOY4Uf2XM56dE2reneJ1uyJBllQAFAHt+Uhq:TB6zg2cdyW2N2lueklRvDvrTwOYVf2XD
TLSH T104E5D2711354D532A22CA71F92F7ED30590A68135DCAEF3D3068921976ACD1BA36CBF2
Magika javascript
Reporter lowmal3
Tags:FormBook js

Intelligence

File Origin
# of uploads :
1
# of downloads :
207
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.JS.Muldrop.1628.6694.16428.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6aeae0711a457820544ad949
Tags:
autorun emotet proxy
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Running batch commands
Creating a process with a hidden window
Changing the Zone.Identifier stream
Creating a file
Creating synchronization primitives
Sending a custom TCP request
Creating a process from a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug dropper evasive obfuscated packed repaired
Link:
https://www.filescan.io/uploads/6aeae06f4259b1638a894599/reports/f0daed7e-0be4-4aaf-9b8f-19d70c213388/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/2e90337407e97c12f994d4d2a981a29516633c657f962ff94ba2c1f1ca22f4e4
Verdict:
Malicious
File Type:
js
First seen:
2026-11-03T03:36:00Z UTC
Last seen:
2026-11-05T06:26:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/2e90337407e97c12f994d4d2a981a29516633c657f962ff94ba2c1f1ca22f4e4/results?tab=lookup
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1997951
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
Creates autostart registry keys with suspicious values (likely registry only malware)
Drops PE files to the document folder of the user
Found API chain indicative of debugger detection
Found direct / indirect Syscall (likely to bypass EDR)
JavaScript source code contains call to eval() to check own source code (likely for evading instrumentation)
JavaScript source code contains functionality to generate code involving a shell, file or stream
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
WScript reads language and country specific registry keys (likely country aware script)
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1997951 Sample: PO_N0_98076.JS.js Startdate: 04/11/2026 Architecture: WINDOWS Score: 100 39 www.tomatox.com.tw 2->39 41 www.tbhsserv.net 2->41 43 7 other IPs or domains 2->43 67 Suricata IDS alerts for network traffic 2->67 69 Antivirus detection for URL or domain 2->69 71 Multi AV Scanner detection for submitted file 2->71 73 5 other signatures 2->73 8 wscript.exe 1 4 2->8         started        12 5ccg8zBopVoF8.exe 2->12 injected 14 V6Z4MxZ4P.exe 2->14 injected signatures3 process4 dnsIp5 35 C:\Users\user\...\CALCJFECITDQHIPN.exe, PE32 8->35 dropped 37 C:\Users\user\Documents37PIHQDTICEFJCLAC, ASCII 8->37 dropped 75 Benign windows process drops PE files 8->75 77 Drops PE files to the document folder of the user 8->77 79 Windows Scripting host queries suspicious COM object (likely to drop second stage) 8->79 81 WScript reads language and country specific registry keys (likely country aware script) 8->81 17 CALCJFECITDQHIPN.exe 1 2 8->17         started        21 cmd.exe 1 8->21         started        83 Maps a DLL or memory area into another process 12->83 85 Found direct / indirect Syscall (likely to bypass EDR) 12->85 23 wextract.exe 13 12->23         started        45 qunvero.shop 165.140.119.207, 49708, 80 SOLID-SolidSystemsLLCUS Netherlands 14->45 47 www.maltalatintours.com 35.214.246.166, 49723, 49724, 49725 GOOGLE-2-GoogleLLCUS Netherlands 14->47 49 5 other IPs or domains 14->49 file6 signatures7 process8 file9 31 C:\Users\user\...31PIHQDTICEFJCLAC.vbs, ASCII 17->31 dropped 51 Creates autostart registry keys with suspicious values (likely registry only malware) 17->51 53 Found API chain indicative of debugger detection 17->53 55 Modifies the context of a thread in another process (thread injection) 17->55 65 3 other signatures 17->65 25 conhost.exe 17->25         started        33 C:\...\PO_N0_98076.JS.js:Zone.Identifier, ASCII 21->33 dropped 27 conhost.exe 21->27         started        57 Tries to steal Mail credentials (via file / registry access) 23->57 59 Tries to harvest and steal browser information (history, passwords, etc) 23->59 61 Maps a DLL or memory area into another process 23->61 63 Unusual module load detection (module proxying) 23->63 29 firefox.exe 23->29         started        signatures10 process11
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/2e90337407e97c12f994d4d2a981a29516633c657f962ff94ba2c1f1ca22f4e4
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
Javascript T1059.007
Link:
https://app.malva.re/file/fd76bbd5a550246497adf3997a2701d4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2e90337407e97c12f994d4d2a981a29516633c657f962ff94ba2c1f1ca22f4e4/
Threat name:
Script-JS.Trojan.ModiLoader
Create hunting rule
Status:
Malicious
First seen:
2026-11-03 10:03:26 UTC
File Type:
Text (JavaScript)
AV detection:
14 of 38 (36.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f2idg5ah5f6bf6mu2tjktancsulggpdfp6lc76klula7dsrc6tsa._file
Verdict:
malicious
Label(s):
Formbook
Create hunting rule
Link:
https://reports.threatray.com/b99234ff-a529-439d-b6b6-8afbef4fe219
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook defense_evasion execution persistence privilege_escalation rat spyware stealer trojan
Link:
https://tria.ge/reports/261104-jfcf9sty9m/
Behaviour
Modifies registry class
NTFS ADS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Executes a command shell one-liner
Executes a VBScript file via the Windows Script Host.
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Family: Formbook
Formbook payload
Malware Family:
modiloader
Create hunting rule
Malicious:
True
Tags:
javascript
Link:
https://intel.virussign.com/intelligence/file/2e90337407e97c12f994d4d2a981a29516633c657f962ff94ba2c1f1ca22f4e4
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2e90337407e9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2e90337407e97c12f994d4d2a981a29516633c657f962ff94ba2c1f1ca22f4e4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:data_manipulation
Create hunting rule
Author:Serhii Kocherhan
Description:Detects data manipulation routines including XOR encoding, Base64 references, and RC4 PRGA encryption
Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:Entroprism_AIP_AIP_20261104_D001
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D002
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D005
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D007
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.dll_hijack -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D008
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D009
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D012
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D013
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D014
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> inject.apc -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D015
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D016
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D017
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D018
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D019
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D022
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D024
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.bootkit -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D025
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D026
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D028
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D029
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D030
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D031
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D032
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> evasion.sandbox -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D033
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D034
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D037
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D038
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D040
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D042
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D043
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D045
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D047
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D048
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D049
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D051
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> evasion.amsi_bypass -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D052
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.service -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D053
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D054
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D055
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D056
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D057
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D059
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D061
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D064
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D065
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D066
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D067
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D068
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.startup_folder -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D069
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D070
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.bootkit -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D071
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.bootkit -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D072
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D075
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D078
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D079
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> evasion.sandbox -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D081
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D082
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D083
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D084
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.startup_folder -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D086
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D088
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D089
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D090
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D091
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D093
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.dll_hijack -> inject.apc -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D094
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.pack -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D096
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D097
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D098
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D099
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D101
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D102
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> evasion.pack -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D103
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D105
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D106
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D107
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D108
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D109
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D112
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D113
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D116
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D117
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D120
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D121
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D122
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D123
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D124
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D125
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D129
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D130
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D131
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D132
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D133
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D134
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D136
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D137
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D138
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D139
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.service -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D140
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.registry_run -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D141
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D144
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D145
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.service -> evasion.etw_disable -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D146
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D147
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D148
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D149
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.startup_folder -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D151
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D152
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D153
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D159
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D160
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D161
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D162
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D164
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D165
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D166
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.startup_folder -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D169
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D170
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.startup_folder -> evasion.pack -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D171
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D172
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D173
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D176
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D177
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D178
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D180
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> inject.apc -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D181
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D182
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D183
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D184
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D185
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.bootkit -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D187
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D188
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D189
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D190
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D191
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D192
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D194
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D195
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.service -> inject.apc -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D196
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> evasion.pack -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D197
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D198
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D199
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D200
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.startup_folder -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D001
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D003
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D004
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D005
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.service -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D008
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> evasion.pack -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D009
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D010
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D011
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D012
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D013
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D014
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D015
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D018
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D020
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D021
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D022
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D025
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D026
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> evasion.pack -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D027
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D028
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D031
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D032
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D034
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D035
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D036
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D037
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D039
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D040
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D042
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D043
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D044
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D045
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D046
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D047
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D048
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D050
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.registry_run -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D051
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D053
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D056
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D058
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D059
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.service -> evasion.pack -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D061
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D062
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D063
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D064
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D065
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D069
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D070
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D071
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D072
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D073
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.dll_hijack -> inject.apc -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D074
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D075
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.pack -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D077
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D078
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D079
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D081
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D082
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D084
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D085
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D086
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D087
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D088
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D089
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D092
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.dll_hijack -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D094
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D095
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D096
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D097
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D098
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.bootkit -> evasion.etw_disable -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D101
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D102
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D104
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D105
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D106
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D107
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D110
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.bootkit -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D111
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> inject.apc -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D112
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D113
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D114
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D115
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D116
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.startup_folder -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D119
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D120
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.registry_run -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D121
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D124
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D125
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D126
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D127
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> inject.apc -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D128
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D129
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D131
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> evasion.sandbox -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D133
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D134
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D137
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D138
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D139
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> evasion.sandbox -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D140
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D142
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D143
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D144
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D145
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D146
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D147
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D150
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D151
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D154
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D155
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D156
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.service -> inject.apc -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D158
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D160
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D162
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.service -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D163
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D164
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D166
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D167
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.startup_folder -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D168
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D169
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.registry_run -> inject.apc -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D170
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D171
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D172
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D173
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D175
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D178
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.startup_folder -> evasion.sandbox -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D179
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D180
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D181
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D182
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D183
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D184
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D185
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> evasion.etw_disable -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D186
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D187
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D189
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.service -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D190
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D193
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.bootkit -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D194
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.bootkit -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D196
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D198
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D199
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D200
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:MULTI_Malware_AgentTesla_ForgeAuto_ed343f78_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects AgentTesla (inconnu, etat extrait)
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:SUSP_VBS_Randomized_ActiveX_Downloader
Create hunting rule
Author:Marjoriefort
Description:Dropper VBS obfusque : ActiveXObject a identifiant randomise (20 MAJ), SaveToFile, .Run
Reference:Veille fraicheur 2026-09-14 / grappe VBS randomisee
Rule name:TH_Win_ETW_Bypass_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Windows ETW Bypass Detection Rule - 2025
Reference:https://cyfare.net/
Rule name:WIN_Malware_SalatStealer_ForgeAuto_542e717b
Create hunting rule
Author:Marjoriefort
Description:Detects SalatStealer (pe, etat binaire)
Rule name:WIN_Malware_Sliver_ForgeAuto_2ddb463c
Create hunting rule
Author:Marjoriefort
Description:Detects Sliver (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_2ffc3572
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_5001c94c
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_ce8c5b46
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_ValleyRAT_ForgeAuto_401c5e16
Create hunting rule
Author:Marjoriefort
Description:Detects ValleyRAT (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments