Potential APT10 Cloud Hopper Activity

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

Detects potential process and execution activity related to the APT10 Cloud Hopper operation. Specifically, it looks for `cscript.exe` executing VBScripts with a `/shell` argument and `csvde` commands attempting to export data to a log file in `C:\windows\web\`.