IOC Hunting: Detection of Known Malicious Hashes

Thomas Carr@Tomcat

•updated Jul 10, 2025•55•18•401

This rule detects the presence of specific file hashes (MD5, SHA1, SHA256) across device file events, device process events, and email attachment information. It is designed to identify known malicious files or indicators of compromise (IOCs) within an environment.