Greenbug Espionage Group Indicators
This rule detects specific file paths, command-line arguments, and PowerShell commands associated with the Greenbug espionage group's May 2020 campaign, as reported by Symantec. It looks for suspicious executables in ProgramData directories, the use of 'revshell.exe' and 'ncat.exe' (especially with '-e cmd.exe'), and various PowerShell command patterns indicative of malicious activity, including base64 encoded strings.
Sigma
