Lazarus Group Activity Detection
Detects various process execution behaviors associated with the Lazarus Group, including attempts to dump SAM registry hive, network connection enumeration using netstat, network share discovery patterns, persistence mechanisms involving common program data directories, and rundll32 execution with specific file extensions.
Sigma
