MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ffda210cd2741cf8dad1133e7f0e021015d40b6a1173cac8082dcc04d31fbbdb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 17

Maldoc score: 32

Intelligence 17 IOCs YARA 305 File information Comments

SHA256 hash:	ffda210cd2741cf8dad1133e7f0e021015d40b6a1173cac8082dcc04d31fbbdb
SHA3-384 hash:	31fbb099b6abac17ed1b38cb3ff9ef0d958042af04e84ec4642c810ad756d4ef3e7682b96fae7652c4a52d903b9c887d
SHA1 hash:	7da6c080595447ab9ba7cb150e24bb9490614f94
MD5 hash:	83d07f40807b192605725c77be65fe28
humanhash:	florida-finch-saturn-failed
File name:	PO 6800009180.doc
Download:	download sample
File size:	208'896 bytes
First seen:	2026-11-04 10:41:20 UTC
Last seen:	Never
File type:	doc
MIME type:	application/msword
ssdeep	3072:CDayRNNDLk5a+c5Cd7bI8JyRfDIrkbwrKNhW2Ti/78L0Lo324g6PL+dT8uRmgevc:CDRNDLcc5Cd7YLXJie327x3UHUwk
TLSH	T18A14B32439EA801EF273EF765BD4B9AADD2FFE732A06945A2041334A4633D81DD8153D
TrID	38.7% (.4PK) Perfect Keyboard macro set (36000/1/2) 32.2% (.DOC) Microsoft Word document (30000/1/2) 20.4% (.DOC) Microsoft Word document (old ver.) (19000/1/2) 8.6% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	doc
Reporter	abuse_ch
Tags:	doc

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

Maldoc score: 32

Application name is Microsoft Office

Author of this document is Admini

File Format is MS Word 97-2003

Container Format is OLE

Office document contains VBA Macros

OLE dump

MalwareBazaar was able to identify 10 sections in this file using oledump:

Section ID	Section size	Section name
1	114 bytes	CompObj
2	4096 bytes	DocumentSummaryInformation
3	4096 bytes	SummaryInformation
4	126564 bytes	1Table
5	365 bytes	Macros/PROJECT
6	41 bytes	Macros/PROJECTwm
7	6101 bytes	Macros/VBA/ThisDocument
8	3089 bytes	Macros/VBA/_VBA_PROJECT
9	522 bytes	Macros/VBA/dir
10	57697 bytes	WordDocument

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Type	Keyword	Description
AutoExec	Document_Open	Runs when the Word or Publisher document isopened
Suspicious	expandenvironmentstrings	May read system environment variables
Suspicious	Open	May open a file
Suspicious	Write	May write to a file (if combined with Open)
Suspicious	ADODB.Stream	May create a text file
Suspicious	WriteText	May create a text file
Suspicious	SaveToFile	May create a text file
Suspicious	shell	May run an executable file or a systemcommand
Suspicious	wscript.shell	May run an executable file or a systemcommand
Suspicious	CreateObject	May create an OLE object
Suspicious	Xor	May attempt to obfuscate specific strings(use option --deobf to deobfuscate)
Suspicious	.Variables	May use Word Document Variables to store andhide data
Suspicious	run	May run an executable file or a system
Suspicious	Base64 Strings	Base64-encoded strings were detected, may beused to obfuscate strings (option --decode tosee all)

Intelligence

File Origin

# of uploads :

# of downloads :

169

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

MSO

Details

Link:

https://research.acce.ciphertechsolutions.com/results/4b074a8b-8ad3-4dec-b446-4c9e2184779d/

Malware family:

n/a

ID:

File name:

doc

Verdict:

Malicious activity

Analysis date:

2026-11-04 10:59:31 UTC

Tags:

generated-doc macros macros-on-open phish-ml-doc arch-doc

Link:

https://app.any.run/tasks/e6bbe539-9a47-4ec6-9c71-bd7aaeb20e45

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Legit

File type:

application/msword

Has a screenshot:

False

Contains macros:

False

Detection(s):

Sanesecurity.Badmacro.Doc.blankopen.UNOFFICIAL

SecuriteInfo.com.Office.Macro-15.UNOFFICIAL

TwinWave.EvilDoc.CROMiscreantNeuralLinkTerra.20210721.UNOFFICIAL

TwinWave.EvilDoc.CROStringGamesBangBang.20200908.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6aeb0c0d3970fcef1e4b019c

Tags:

office macro micro java

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating synchronization primitives

Creating a file in the %AppData% directory

Creating a process with a hidden window

Sending a custom TCP request

Launching a process by exploiting the app vulnerability

Result

Verdict:

Malicious

File Type:

Legacy Word File with Macro

Link:

https://app.docguard.net/ffda210cd2741cf8dad1133e7f0e021015d40b6a1173cac8082dcc04d31fbbdb/results/dashboard

Behaviour

BlacklistAPI detected

Document image

Image:

Download PNG

Gathering data

Verdict:

Malicious

Labled as:

Msoffice/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/ffda210cd2741cf8dad1133e7f0e021015d40b6a1173cac8082dcc04d31fbbdb

Label:

Benign

Suspicious Score:

/10

Score Malicious:

Score Benign:

Link:

https://www.malware.ai/gui/files/?id=6506524d-4f69-4035-a701-63bcd854366b

Verdict:

Malicious

File Type:

doc

First seen:

2026-11-03T11:14:00Z UTC

Last seen:

2026-11-04T22:46:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/ffda210cd2741cf8dad1133e7f0e021015d40b6a1173cac8082dcc04d31fbbdb/results?tab=lookup

Result

Threat name:

Caesium Obfuscator

Detection:

malicious

Classification:

phis.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1998069

Signature

AI detected malicious page (phishing or scam)

Antivirus / Scanner detection for submitted sample

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Document exploit detected (creates forbidden files)

Document exploit detected (process start blacklist hit)

Exploit detected, runtime environment starts unknown processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Office process queries suspicious COM object (likely to drop second stage)

Yara detected AllatoriJARObfuscator

Yara detected Caesium Obfuscator

Behaviour

Behavior Graph:

Download SVG

Verdict:

Malware

YARA:

5 match(es)

Tags:

ADODB.Stream Blacklist VBA COM Behavior Trace DeObfuscated MSScriptControl.ScriptControl Obfuscated Office Document SOS: 0.24 T1027 T1059.005 VBScript wscript.shell

Link:

https://app.malva.re/file/83d07f40807b192605725c77be65fe28

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ffda210cd2741cf8dad1133e7f0e021015d40b6a1173cac8082dcc04d31fbbdb/

Threat name:

Win32.Trojan.TrickBot

Status:

Malicious

First seen:

2026-11-04 00:58:19 UTC

File Type:

Document

Extracted files:

AV detection:

15 of 23 (65.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=77nccdgsoqoprwwrcm7h6dqccak5ic3kcfz4vsaifxgajuy7xpnq._file

Result

Malware family:

n/a

Score:

8/10

Tags:

macro macro_on_action

Link:

https://tria.ge/reports/261104-mrs5yahs9z/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Malware Family:

n/a

Verdict:

Suspicious

Tags:

n/a

YARA:

office_document_vba Office_Document_with_VBA_Project Contains_VBA_macro_code

Link:

https://app.threat.zone/submission/c736f069-6ef5-4dba-8bbe-26ce97149d76

Malware Family:

argo1

Malicious:

True

Tags:

macros obfuscated create-ole open-file write-file doc create-file auto-open run-file environ persistence crypto checks-network-adapters idle

Link:

https://intel.virussign.com/intelligence/file/ffda210cd2741cf8dad1133e7f0e021015d40b6a1173cac8082dcc04d31fbbdb

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ffda210cd2741cf8dad1133e7f0e021015d40b6a1173cac8082dcc04d31fbbdb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Entroprism_AIP_AIP_20261104_D001 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D002 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D005 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D007 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.dll_hijack -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D008 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D009 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D012 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D013 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D014 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> inject.apc -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D015 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D016 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D017 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D018 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D019 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D022 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D024 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.bootkit -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D025 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D026 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D028 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D029 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D030 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D031 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D032 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> evasion.sandbox -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D033 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D034 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D037 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D038 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D040 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D042 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D043 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D045 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D047 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D048 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D049 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D051 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> evasion.amsi_bypass -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D052 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.service -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D053 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D054 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D055 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D056 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D057 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D059 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D061 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D064 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D065 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D066 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D067 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D068 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.startup_folder -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D069 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D070 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.bootkit -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D071 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.bootkit -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D072 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D075 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D078 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D079 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> evasion.sandbox -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D081 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D082 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D083 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D084 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.startup_folder -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D086 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D088 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D089 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D090 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D091 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D093 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.dll_hijack -> inject.apc -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D094 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.pack -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D096 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D097 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D098 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D099 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D101 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D102 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> evasion.pack -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D103 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D105 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D106 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D107 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D108 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D109 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D112 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D113 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D116 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D117 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D120 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D121 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D122 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D123 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D124 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D125 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D129 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D130 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D131 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D132 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D133 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D134 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D136 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D137 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D138 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D139 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.service -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D140 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.registry_run -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D141 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D144 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D145 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.service -> evasion.etw_disable -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D146 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D147 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D148 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D149 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.startup_folder -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D151 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D152 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D153 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D159 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D160 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D161 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D162 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D164 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D165 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D166 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.startup_folder -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D169 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D170 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.startup_folder -> evasion.pack -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D171 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D172 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D173 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D176 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D177 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D178 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D180 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> inject.apc -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D181 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D182 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D183 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D184 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D185 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.bootkit -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D187 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D188 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D189 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D190 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D191 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D192 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D194 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D195 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.service -> inject.apc -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D196 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> evasion.pack -> c2.icmp

Rule name:	Entroprism_AIP_AIP_20261104_D197 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D198 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.dns_tunnel

Rule name:	Entroprism_AIP_AIP_20261104_D199 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_AIP_20261104_D200 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.startup_folder -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D001 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D003 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D004 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D005 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.service -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D008 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> evasion.pack -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D009 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D010 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D011 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D012 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D013 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D014 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D015 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D018 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D020 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D021 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D022 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D025 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D026 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> evasion.pack -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D027 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D028 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D031 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D032 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D034 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D035 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D036 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D037 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D039 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D040 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D042 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D043 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D044 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D045 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D046 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D047 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D048 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D050 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.registry_run -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D051 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D053 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D056 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D058 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D059 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.service -> evasion.pack -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D061 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D062 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D063 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D064 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D065 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D069 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D070 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D071 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D072 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D073 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.dll_hijack -> inject.apc -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D074 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D075 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.pack -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D077 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D078 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D079 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D081 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D082 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D084 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D085 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D086 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D087 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D088 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D089 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D092 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.dll_hijack -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D094 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D095 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D096 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D097 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D098 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.bootkit -> evasion.etw_disable -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D101 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D102 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D104 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D105 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D106 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D107 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D110 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.bootkit -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D111 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> inject.apc -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D112 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D113 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D114 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D115 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D116 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.startup_folder -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D119 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D120 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.registry_run -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D121 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D124 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D125 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D126 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D127 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> inject.apc -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D128 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D129 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D131 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> evasion.sandbox -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D133 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D134 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D137 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D138 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D139 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> evasion.sandbox -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D140 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D142 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D143 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D144 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.dll_hijack -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D145 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.service -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D146 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D147 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D150 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D151 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D154 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D155 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D156 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.service -> inject.apc -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D158 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D160 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D162 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.service -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D163 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D164 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D166 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.bootkit -> evasion.pack -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D167 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.startup_folder -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D168 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D169 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.registry_run -> inject.apc -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D170 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D171 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D172 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D173 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.pack -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D175 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D178 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.startup_folder -> evasion.sandbox -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D179 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> evasion.etw_disable -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D180 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D181 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D182 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.amsi_bypass -> c2.icmp

Rule name:	Entroprism_AIP_FREE_20261120_D183 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D184 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D185 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.startup_folder -> evasion.etw_disable -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D186 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.schtasks -> inject.apc -> c2.dns_tunnel

Rule name:	Entroprism_AIP_FREE_20261120_D187 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D189 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.service -> evasion.sandbox -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D190 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D193 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.bootkit -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D194 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.bootkit -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D196 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: exploit.upload -> payload.transform -> persist.dll_hijack -> evasion.amsi_bypass -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D198 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D199 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: bruteforce.rdp -> payload.transform -> persist.registry_run -> inject.apc -> c2.http_beacon

Rule name:	Entroprism_AIP_FREE_20261120_D200 Create hunting rule
Author:	Entroprism (Beijing Yijun Foreign Trade Co., Ltd.)
Description:	Entroprism AIP defensive validation: driveby.exploit_kit -> payload.transform -> persist.schtasks -> inject.apc -> c2.http_beacon

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	informational_win_ole_protected Create hunting rule
Author:	Jeff White (karttoon@gmail.com) @noottrak
Description:	Identify OLE Project protection within documents.

Rule name:	MULTI_Malware_AgentTesla_ForgeAuto_ed343f78_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects AgentTesla (inconnu, etat extrait)

Rule name:	MULTI_Malware_Unknown_ForgeAuto_0fd7af39_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (inconnu, etat extrait)

Rule name:	MULTI_Malware_Unknown_ForgeAuto_1ec7d1c2_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (archive, etat extrait)

Rule name:	MULTI_Malware_Unknown_ForgeAuto_4f67e0b3_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (archive, etat extrait)

Rule name:	MULTI_Malware_Unknown_ForgeAuto_57b77e4a_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (archive, etat extrait)

Rule name:	MULTI_Malware_Unknown_ForgeAuto_e38c53ae_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (archive, etat extrait)

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	WIN_Malware_ACRStealer_ForgeAuto_1084c837_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects ACRStealer (pe, etat extrait)

Rule name:	WIN_Malware_Fantom_ForgeAuto_98e6f354_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Fantom (pe, etat extrait)

Rule name:	WIN_Malware_PythonStealer_ForgeAuto_b24cb5bd Create hunting rule
Author:	Marjoriefort
Description:	Detects PythonStealer (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_2ffc3572 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_5001c94c Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_7e8e91c4 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample