GALLIUM IOCs Detected via Process Hashes
This rule detects the creation of processes with specific SHA1 or SHA256 hashes that have been identified as indicators of compromise (IOCs) associated with the GALLIUM cyber espionage group. These hashes correspond to known malicious executables used by the group. The detection is based on a report by Microsoft Threat Intelligence Center from December 2019, which detailed GALLIUM's targeting of global telecommunications.
Sigma
