UTA0388 GOVERSHELL Activity Detection
Detects various activities associated with the UTA0388 threat actor and their GOVERSHELL malware family. This includes network connections to known C2 infrastructure, creation of persistence via scheduled tasks, and execution of the malware payload, often involving DLL side-loading. The detection logic covers network communication with known C2 domains and IPs, creation of scheduled tasks with specific names, execution of the malware from common staging directories with specific flags, and the dropping of GOVERSHELL DLLs or files with known hashes.
Microsoft Sentinel (KQL)
