🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3fb044653334e89c68176d670bedbec83c2e09a2a609b4814eee1575fda6da2d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 15


Intelligence 15 IOCs YARA 292 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3fb044653334e89c68176d670bedbec83c2e09a2a609b4814eee1575fda6da2d
SHA3-384 hash: 15e145441bb5d416dda3fd67038e3730e4d5ae731033919abf92c71e821d38b2603107edf7ea0c6fc4f18160ef22edfc
SHA1 hash: dde386a31367ebf46b639fd39479d326bad33c74
MD5 hash: 36c622ee115ddeb6d45993eb0b7c3560
humanhash: texas-uncle-cat-juliet
File name:QUOTATIONFROMMINGRAYTECHNOLOGYGROUP.pdf.scr$
Download: download sample
Signature MassLogger
Create hunting rule
File size:2'665'984 bytes
First seen:2026-11-03 06:43:43 UTC
Last seen:2026-11-03 07:41:47 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
ssdeep 49152:x8qzA1u95oChenXg4lL7j5dOkaKHuhEOkT+ku3dg:dM1aRqhj5zfOOOT53d
TLSH T145C5020823D4DA09E5B607F2DD26D1F0137A2F5AE522D26BDDD1BEDB7839F702A50242
TrID 44.6% (.EXE) Win64 Executable (generic) (6522/11/2)
14.0% (.ICL) Windows Icons Library (generic) (2059/9)
13.8% (.EXE) OS/2 Executable (generic) (2029/13)
13.7% (.EXE) Generic Win/DOS Executable (2002/3)
13.6% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter ni_fi_701
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
214
Origin country :
AT AT
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-03 07:00:17 UTC
Tags:
netreactor telegram ip-check evasion exfiltration stealer phantom chromelevator ims-api generic
Link:
https://app.any.run/tasks/3cc50e81-a2d1-4874-b661-f698992433d9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
PhantomStealer
Create hunting rule
Link:
https://www.capesandbox.com/analysis/96915/
Detection(s):
SecuriteInfo.com.Win64.MalwareX-gen.86445363.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae982cb1a457820544ac228
Tags:
underscore injection keylog word
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Restart of the analyzed sample
Creating a file
Creating synchronization primitives
Using the Windows Management Instrumentation requests
Setting a keyboard event handler
Creating a file in the %temp% subdirectories
Launching a process
DNS request
Connection attempt
Sending an HTTP GET request
Deleting a recently created file
Unauthorized injection to a recently created process
Unauthorized injection to a system process
Forced shutdown of a browser
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/3fb044653334e89c68176d670bedbec83c2e09a2a609b4814eee1575fda6da2d
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-11-02T23:59:00Z UTC
Last seen:
2026-11-05T02:59:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/3fb044653334e89c68176d670bedbec83c2e09a2a609b4814eee1575fda6da2d/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f2c88cdf-f0df-467f-b54f-0bc8bfc9959b
Result
Threat name:
KeyLogger, MicroClip, Phantom stealer, T
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1997193
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Allocates memory in foreign processes
Creates a thread in another existing process (thread injection)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected chromElevator
Yara detected Keylogger Generic
Yara detected MicroClip
Yara detected Phantom stealer
Yara detected Telegram RAT
Yara detected TrojanRansom
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1997193 Sample: QUOTATIONFROMMINGRAYTECHNOL... Startdate: 03/11/2026 Architecture: WINDOWS Score: 100 41 api.telegram.org 2->41 43 icanhazip.com 2->43 45 cl-glcb907925.gcdn.co 2->45 61 Suricata IDS alerts for network traffic 2->61 63 Found malware configuration 2->63 65 Malicious sample detected (through community Yara rule) 2->65 69 12 other signatures 2->69 10 QUOTATIONFROMMINGRAYTECHNOLOGYGROUP.pdf.scr$.exe 3 2->10         started        signatures3 67 Uses the Telegram API (likely for C&C communication) 41->67 process4 file5 39 QUOTATIONFROMMINGR...UP.pdf.scr$.exe.log, ASCII 10->39 dropped 71 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 10->71 73 Found many strings related to Crypto-Wallets (likely being stolen) 10->73 75 Modifies the context of a thread in another process (thread injection) 10->75 77 Injects a PE file into a foreign processes 10->77 14 QUOTATIONFROMMINGRAYTECHNOLOGYGROUP.pdf.scr$.exe 14 19 10->14         started        signatures6 process7 dnsIp8 47 api.telegram.org 149.154.166.110, 443, 49711, 49719 TELEGRAMVG Netherlands 14->47 49 104.16.184.241, 49745, 49747, 49748 CLOUDFLARENET-CloudflareIncUS Canada 14->49 51 icanhazip.com 104.16.185.241, 49709, 49717, 49723 CLOUDFLARENET-CloudflareIncUS Canada 14->51 79 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->79 81 Tries to steal Mail credentials (via file / registry access) 14->81 83 Writes to foreign memory regions 14->83 85 4 other signatures 14->85 18 rundll32.exe 7 14->18         started        21 rundll32.exe 14->21         started        signatures9 process10 signatures11 53 Writes to foreign memory regions 18->53 55 Allocates memory in foreign processes 18->55 57 Creates a thread in another existing process (thread injection) 18->57 23 chrome.exe 18->23         started        25 msedge.exe 18->25         started        27 conhost.exe 18->27         started        59 Injects a PE file into a foreign processes 21->59 29 chrome.exe 21->29         started        31 msedge.exe 21->31         started        33 conhost.exe 21->33         started        process12 process13 35 WerFault.exe 12 23->35         started        37 WerFault.exe 3 16 29->37         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3fb044653334e89c68176d670bedbec83c2e09a2a609b4814eee1575fda6da2d
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.44 Win 64 Exe x64
Link:
https://app.malva.re/file/36c622ee115ddeb6d45993eb0b7c3560
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3fb044653334e89c68176d670bedbec83c2e09a2a609b4814eee1575fda6da2d/
Threat name:
ByteCode-MSIL.Spyware.Kryptikagen
Create hunting rule
Status:
Malicious
First seen:
2026-11-03 04:04:52 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
11
AV detection:
25 of 38 (65.79%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h6yeizjtgtujy2axnvtqx3n6za6c4cncuye3jako5ykxl7ng3iwq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
collection discovery spyware stealer
Link:
https://tria.ge/reports/261103-hhmvcazvcw/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
Reads the TCP/IP host and domain name from the registry
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads user/profile data of web browsers
Malware Family:
n/a
Verdict:
Malicious
Tags:
injector stealer rat evasion
YARA:
pe_no_import_table
Link:
https://app.threat.zone/submission/bffcbc28-8924-404f-9559-3fba2a25321f
Malware Family:
msil
Create hunting rule
Malicious:
True
Tags:
detect-debug-environment idle long-sleeps 64bits spreader self-delete dotnet obfuscated checks-network-adapters calls-wmi
Link:
https://intel.virussign.com/intelligence/file/3fb044653334e89c68176d670bedbec83c2e09a2a609b4814eee1575fda6da2d
Unpacked files
SH256 hash:
3fb044653334e89c68176d670bedbec83c2e09a2a609b4814eee1575fda6da2d
MD5 hash:
36c622ee115ddeb6d45993eb0b7c3560
SHA1 hash:
dde386a31367ebf46b639fd39479d326bad33c74
Link:
https://www.unpac.me/results/87baf3e8-0fce-46ec-81fe-22ef9112c3d8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.91
Link:
https://yomi.yoroi.company/submissions/3fb044653334e89c68176d670bedbec83c2e09a2a609b4814eee1575fda6da2d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DotNet_RGB_Embedded_AssemblyLoader_Hunt
Create hunting rule
Author:ShadowOpCode
Description:Hunt .NET bitmap RGB extraction combined with embedded resources and assembly loading
Rule name:Entroprism_AIP_AIP_20261104_D001
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D002
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D005
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D007
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.dll_hijack -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D008
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D009
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D012
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D013
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D014
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> inject.apc -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D015
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D016
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D017
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D018
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D019
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D022
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D024
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.bootkit -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D025
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D026
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D028
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D029
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D030
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D031
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D032
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> evasion.sandbox -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D033
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D034
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D037
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D038
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D040
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D042
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D043
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D045
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D047
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D048
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D049
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D051
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> evasion.amsi_bypass -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D052
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.service -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D053
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D054
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D055
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D056
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D057
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D059
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D061
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D064
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D065
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D066
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D067
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D068
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.startup_folder -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D069
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D070
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.bootkit -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D071
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.bootkit -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D072
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D075
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D078
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D079
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> evasion.sandbox -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D081
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D082
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D083
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D084
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.startup_folder -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D086
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D088
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D089
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D090
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D091
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D093
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.dll_hijack -> inject.apc -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D094
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.pack -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D096
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D097
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D098
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D099
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D101
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D102
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> evasion.pack -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D103
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D105
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D106
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D107
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D108
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D109
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D112
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D113
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D116
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D117
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D120
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D121
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D122
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D123
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D124
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D125
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D129
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D130
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D131
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D132
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D133
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D134
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D136
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D137
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D138
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D139
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.service -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D140
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.registry_run -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D141
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D144
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D145
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.service -> evasion.etw_disable -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D146
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D147
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D148
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D149
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.startup_folder -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D151
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D152
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D153
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D159
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D160
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D161
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D162
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D164
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D165
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D166
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.startup_folder -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D169
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D170
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.startup_folder -> evasion.pack -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D171
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D172
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D173
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D176
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D177
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D178
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D180
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> inject.apc -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D181
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D182
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D183
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D184
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D185
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.bootkit -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D187
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D188
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D189
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D190
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D191
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D192
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D194
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D195
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.service -> inject.apc -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D196
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> evasion.pack -> c2.icmp
Rule name:Entroprism_AIP_AIP_20261104_D197
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D198
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.dns_tunnel
Rule name:Entroprism_AIP_AIP_20261104_D199
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_AIP_20261104_D200
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.startup_folder -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D001
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D003
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D004
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D005
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.service -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D008
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> evasion.pack -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D009
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D010
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D011
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D012
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D013
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D014
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D015
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D018
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D020
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D021
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D022
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D025
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D026
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> evasion.pack -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D027
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D028
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D031
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D032
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D034
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D035
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D036
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D037
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D039
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D040
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D042
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D043
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D044
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D045
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D046
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D047
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D048
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D050
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.registry_run -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D051
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D053
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D056
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D058
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D059
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.service -> evasion.pack -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D061
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D062
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D063
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D064
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D065
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D069
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D070
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D071
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D072
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D073
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.dll_hijack -> inject.apc -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D074
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D075
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.pack -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D077
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D078
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D079
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D081
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D082
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D084
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D085
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D086
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D087
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D088
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D089
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D092
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.dll_hijack -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D094
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D095
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D096
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D097
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D098
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.bootkit -> evasion.etw_disable -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D101
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D102
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D104
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D105
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D106
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D107
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D110
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.bootkit -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D111
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> inject.apc -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D112
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D113
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D114
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D115
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D116
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.startup_folder -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D119
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D120
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.registry_run -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D121
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D124
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D125
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D126
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D127
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> inject.apc -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D128
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D129
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D131
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> evasion.sandbox -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D133
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D134
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D137
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D138
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D139
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> evasion.sandbox -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D140
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D142
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D143
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D144
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D145
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D146
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D147
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D150
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D151
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D154
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D155
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D156
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.service -> inject.apc -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D158
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D160
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D162
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.service -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D163
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D164
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D166
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D167
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.startup_folder -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D168
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D169
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.registry_run -> inject.apc -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D170
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D171
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D172
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D173
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D175
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D178
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.startup_folder -> evasion.sandbox -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D179
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D180
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D181
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D182
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.icmp
Rule name:Entroprism_AIP_FREE_20261120_D183
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D184
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D185
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> evasion.etw_disable -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D186
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.dns_tunnel
Rule name:Entroprism_AIP_FREE_20261120_D187
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D189
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.service -> evasion.sandbox -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D190
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D193
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.bootkit -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D194
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.bootkit -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D196
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.amsi_bypass -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D198
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D199
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon
Rule name:Entroprism_AIP_FREE_20261120_D200
Create hunting rule
Author:Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Derialock (pe, etat extrait)
Rule name:WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects XWorm (pe, etat extrait)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/96915/

Comments