MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec80da754aaa79387be3b97b0fcf6fdc5d9edcf0b424cf60637942dc9a301faa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 21

Intelligence 21 IOCs YARA 309 File information Comments 1

SHA256 hash:	ec80da754aaa79387be3b97b0fcf6fdc5d9edcf0b424cf60637942dc9a301faa
SHA3-384 hash:	b699ab88b57dd8d30cfbd6c1bda4b025ac2103a84ef017d841c11bfbbd5c60530e9cb6785ce382b1233dbe787b7e59eb
SHA1 hash:	91d03e105347d2fa9b6a8eb916362a08ee64a59f
MD5 hash:	62bfcf9c6695bc217dc9cb1472cfcdf6
humanhash:	illinois-cold-spaghetti-nine
File name:	62bfcf9c6695bc217dc9cb1472cfcdf6.exe
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	76'288 bytes
First seen:	2026-11-03 16:25:30 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'322 x AgentTesla, 20'747 x Formbook, 12'407 x SnakeKeylogger)
ssdeep	1536:8G25Ekva3TyVX5uWFxaB7bbty3UGi5+CE6sjnOUVVL/xDDzc:725Ekv0U5uWTo7bbtQP1VjnOSL5nzc
TLSH	T133737C283BE64125E0FF6B715DF17297CB3AF6235903D65F24C5028B1A23E898E416F9
TrID	70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.2% (.EXE) Win64 Executable (generic) (6522/11/2) 4.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	abuse_ch
Tags:	AsyncRAT exe RAT

Intelligence

File Origin

# of uploads :

# of downloads :

254

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

XWorm

Details

Link:

https://research.acce.ciphertechsolutions.com/results/47656f47-394f-44a8-942f-f9470119a41b/

Malware family:

n/a

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-11-03 16:33:27 UTC

Tags:

ip-check auto-reg auto-startup xworm

Link:

https://app.any.run/tasks/2a60a403-310f-47e6-99dd-ea9ebd46f4c3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

XWorm

Link:

https://www.capesandbox.com/analysis/96997/

Detection(s):

ditekSHen.MALWARE.Win.Trojan.AsyncRAT.UNOFFICIAL

ditekSHen.MALWARE.Win.XWorm.UNOFFICIAL

Win.Dropper.Nanocore-10024427-0

Win.Malware.Deepscan-10028866-0

Win.Packed.Loveletter-10023052-0

Win.Packed.Msilzilla-10024808-0

Win.Packed.Msilzilla-10026193-0

Win.Packed.njRAT-10002074-1

YARA.SEKOIA_Rat_Win_Xworm_V3.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6aea0b341a457820544acd43

Tags:

loveletter asyncrat nanocore njrat

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating synchronization primitives

Using the Windows Management Instrumentation requests

DNS request

Connection attempt

Sending an HTTP GET request

Creating a process with a hidden window

Creating a file

Deleting a recently created file

Replacing files

Creating a window

Sending a custom TCP request

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Setting a global event handler for the keyboard

Adding an exclusion to Microsoft Defender

Enabling autorun by creating a file

Gathering data

Verdict:

Malicious

Labled as:

Trojan[Banker]/MSIL.ClipBanker

Link:

https://www.hybrid-analysis.com/sample/ec80da754aaa79387be3b97b0fcf6fdc5d9edcf0b424cf60637942dc9a301faa

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-10-31T04:49:00Z UTC

Last seen:

2026-11-04T18:46:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/ec80da754aaa79387be3b97b0fcf6fdc5d9edcf0b424cf60637942dc9a301faa/results?tab=lookup

Malware family:

XWorm

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/fbf07d1e-a373-4d82-a681-df5c8bb6372b

Result

Threat name:

XWorm

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1997555

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Found malware configuration

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Suricata IDS alerts for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected XWorm

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/ec80da754aaa79387be3b97b0fcf6fdc5d9edcf0b424cf60637942dc9a301faa

Verdict:

XWorm

YARA:

15 match(es)

Tags:

.Net Executable Managed .NET PE (Portable Executable) PE File Layout RAT SOS: 0.93 Win 32 Exe x86 XWorm

Link:

https://app.malva.re/file/62bfcf9c6695bc217dc9cb1472cfcdf6

Detection:

xworm

Link:

https://mwdb.cert.pl/sample/ec80da754aaa79387be3b97b0fcf6fdc5d9edcf0b424cf60637942dc9a301faa/

Threat name:

ByteCode-MSIL.Backdoor.AsyncRAT

Status:

Malicious

First seen:

2026-11-01 15:11:09 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

31 of 36 (86.11%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=5sanu5kkvj4tq67dxf5q7t3p3roz5xhqwqsm6yddpfbnzgrqd6va._file

Verdict:

malicious

Label(s):

XWorm

Link:

https://reports.threatray.com/8fad5f67-28d1-42c0-84c3-2f50963684bb

Result

Malware family:

xworm

Score:

10/10

Tags:

family:xworm discovery rat trojan

Link:

https://tria.ge/reports/261103-txn7haxv3l/

Behaviour

Suspicious use of AdjustPrivilegeToken

Reads the TCP/IP host and domain name from the registry

Looks up external IP address via web service

Detect Xworm Payload

Family: Xworm

Malware Config

C2 Extraction:

51.222.88.203:65000

Malware Family:

XWorm

Verdict:

Malicious

Tags:

xworm xworm config_extracted loader stealer rat evasion

YARA:

family_xworm Xworm EXE_RAT_XWorm_April2024 win_xworm_bytestring MALWARE_Win_XWorm INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA WMI_strings

Link:

https://app.threat.zone/submission/31dbfa6f-2496-46f2-8760-899d98ce0388

Malware Config

C2 Extraction:

51.222.88.203:65000 (3.1)

Unpacked files

SH256 hash:

ec80da754aaa79387be3b97b0fcf6fdc5d9edcf0b424cf60637942dc9a301faa

MD5 hash:

62bfcf9c6695bc217dc9cb1472cfcdf6

SHA1 hash:

91d03e105347d2fa9b6a8eb916362a08ee64a59f

Detections:

win_xworm_a0

win_xworm_w0

XWorm

INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

MALWARE_Win_AsyncRAT

MALWARE_Win_XWorm

win_xworm_bytestring

Link:

https://www.unpac.me/results/138a46fe-7d4f-4139-b7aa-586043a091ad/

Malware family:

XWorm

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/ec80da754aaa/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ec80da754aaa79387be3b97b0fcf6fdc5d9edcf0b424cf60637942dc9a301faa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ByteCode_MSIL_Backdoor_AsyncRAT Create hunting rule
Author:	ReversingLabs
Description:	Yara rule that detects AsyncRAT backdoor.

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	Entroprism_AIP_AIP_20261104_D001 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D002 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D005 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D007 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.dll_hijack -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D008 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D009 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D012 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D013 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D014 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> inject.apc -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D015 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D016 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D017 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D018 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D019 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D022 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D024 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.bootkit -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D025 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D026 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D028 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D029 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D030 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D031 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D032 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> evasion.sandbox -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D033 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D034 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D037 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D038 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D040 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D042 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D043 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D045 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D047 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D048 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D049 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D051 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> evasion.amsi_bypass -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D052 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.service -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D053 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D054 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D055 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D056 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D057 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D059 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D061 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D064 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D065 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D066 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D067 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D068 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.startup_folder -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D069 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D070 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.bootkit -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D071 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.bootkit -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D072 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D075 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D078 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D079 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> evasion.sandbox -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D081 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D082 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D083 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D084 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.startup_folder -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D086 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D088 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D089 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D090 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D091 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D093 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.dll_hijack -> inject.apc -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D094 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.pack -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D096 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D097 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D098 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D099 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D101 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D102 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> evasion.pack -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D103 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D105 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D106 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D107 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D108 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D109 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D112 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D113 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D116 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D117 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D120 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D121 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D122 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D123 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D124 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D125 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D129 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D130 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D131 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D132 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D133 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D134 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D136 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D137 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D138 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D139 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.service -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D140 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.registry_run -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D141 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D144 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D145 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.service -> evasion.etw_disable -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D146 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D147 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D148 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D149 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.startup_folder -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D151 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D152 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D153 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D159 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D160 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D161 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D162 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D164 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D165 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D166 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.startup_folder -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D169 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D170 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.startup_folder -> evasion.pack -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D171 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D172 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D173 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D176 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D177 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D178 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D180 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> inject.apc -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D181 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D182 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D183 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D184 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D185 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.bootkit -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D187 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D188 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D189 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D190 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D191 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D192 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D194 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D195 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.service -> inject.apc -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D196 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> evasion.pack -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D197 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D198 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D199 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D200 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.startup_folder -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D001 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D003 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D004 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D005 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.service -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D008 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> evasion.pack -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D009 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D010 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D011 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D012 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D013 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D014 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D015 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D018 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D020 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D021 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D022 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D025 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D026 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> evasion.pack -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D027 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D028 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D031 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D032 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D034 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D035 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D036 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D037 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D039 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D040 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D042 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D043 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D044 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D045 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D046 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D047 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D048 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D050 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.registry_run -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D051 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D053 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D056 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D058 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D059 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.service -> evasion.pack -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D061 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D062 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D063 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D064 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D065 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D069 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D070 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D071 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D072 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D073 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.dll_hijack -> inject.apc -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D074 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D075 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.pack -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D077 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D078 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D079 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D081 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D082 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D084 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D085 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D086 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D087 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D088 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D089 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D092 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.dll_hijack -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D094 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D095 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D096 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D097 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D098 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.bootkit -> evasion.etw_disable -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D101 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D102 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D104 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D105 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D106 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D107 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D110 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.bootkit -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D111 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> inject.apc -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D112 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D113 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D114 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D115 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D116 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.startup_folder -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D119 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D120 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.registry_run -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D121 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D124 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D125 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D126 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D127 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> inject.apc -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D128 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D129 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D131 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> evasion.sandbox -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D133 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D134 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D137 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D138 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D139 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> evasion.sandbox -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D140 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D142 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D143 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D144 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D145 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D146 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D147 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D150 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D151 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D154 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D155 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D156 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.service -> inject.apc -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D158 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D160 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D162 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.service -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D163 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D164 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D166 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D167 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.startup_folder -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D168 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D169 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.registry_run -> inject.apc -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D170 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D171 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D172 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D173 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D175 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D178 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.startup_folder -> evasion.sandbox -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D179 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D180 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D181 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D182 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D183 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D184 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D185 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> evasion.etw_disable -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D186 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D187 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D189 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.service -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D190 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D193 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.bootkit -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D194 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.bootkit -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D196 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D198 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D199 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D200 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	EXE_RAT_XWorm_April2024 Create hunting rule
Author:	Yashraj Solanki - Cyber Threat Intelligence Analyst at Bridewell

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	MALWARE_Win_AsyncRAT Create hunting rule
Author:	ditekSHen
Description:	Detects AsyncRAT

Rule name:	MALWARE_Win_XWorm Create hunting rule
Author:	ditekSHen
Description:	Detects XWorm

Rule name:	MAL_AsyncRAT_Family_V_0_5_8 Create hunting rule
Author:	Trezzza
Description:	Detects AsyncRAT version 0.5.8 and some other versions of AsyncRAT. The name reflects the analysed sample.

Rule name:	Multifamily_RAT_Detection Create hunting rule
Author:	Lucas Acha (https://www.lukeacha.com)
Description:	Generic detection for multiple RAT families, PUPs, packers and suspicious executables. NOTE: This rule may produce false positives. Updated May 2026 to reduce False Positives.

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	rat_win_xworm_v3 Create hunting rule
Author:	Sekoia.io
Description:	Finds XWorm (version XClient, v3) samples based on characteristic strings

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_DOTNET_PE_List_AV Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detecs .NET Binary that lists installed AVs

Rule name:	SUSP_Script_PowerShell_Hidden_Launcher Create hunting rule
Author:	Marjoriefort
Description:	Script (JS/VBS) lancant PowerShell en mode furtif - dropper frais MalwareBazaar
Reference:	Veille fraicheur 2026-09-14 / cluster misses web

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	win_dotnet_vb_stealer_rat Create hunting rule
Author:	Arrbat
Description:	Detects .NET/VB executables with stealer/RAT capabilities (sockets, HTTP, processes, registry, etc).

Rule name:	WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects XWorm (pe, etat extrait)

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

Rule name:	win_xworm_bytestring Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects bytestring present in unobfuscated xworm

Rule name:	win_xworm_w0 Create hunting rule
Author:	jeFF0Falltrades
Description:	Detects win.xworm.

Rule name:	xworm Create hunting rule
Author:	jeFF0Falltrades

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/96997/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

Jeff Archer commented on 2026-11-03 16:30:45 UTC

RAT King Parser (https://github.com/jeFF0Falltrades/rat_king_parser) Output:

{
"sha256": "ec80da754aaa79387be3b97b0fcf6fdc5d9edcf0b424cf60637942dc9a301faa",
"yara_possible_family": "xworm",
"key": "6a77b856cbf4e5428118da0c5f30ca6a77b856cbf4e5428118da0c5f30ca7e00",
"salt": "None",
"config": {
"obfuscated_key_1": "51.222.88.203",
"obfuscated_key_2": "65000",
"obfuscated_key_3": "<123456789>",
"obfuscated_key_4": "<Xwormmm>",
"obfuscated_key_5": 3,
"obfuscated_key_6": "USB.exe",
"obfuscated_key_7": "%LocalAppData%",
"obfuscated_key_8": "JOE03ynIqD61c7IA",
"obfuscated_key_9": "\\Log.tmp",
"obfuscated_key_10": "BTC_Address",
"obfuscated_key_11": "ETH_Address",
"obfuscated_key_12": "TRC20_Address"
}
}