Turla Group Command-Line Activity (May 2020)

SigmaHQ Detections@sigmaHQ

•updated Oct 29, 2025•1•0•32

Detects specific command-line patterns used by the Turla APT group, as detailed in an ESET report from May 2020. The rule looks for `tracert` commands targeting `yahoo.com`, PowerShell obfuscated commands involving `FromBase64String`, and `net use` commands attempting to connect to `docs.live.net` with an `@aol.co.uk` credential.