HAFNIUM Exchange Exploitation Activity

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•27

Detects various suspicious activities associated with the HAFNIUM threat group targeting Microsoft Exchange servers. This includes attempts to hide files using `attrib`, scheduled task creation for persistence, execution of an unusual Opera browser, shadow copy enumeration, and data staging/exfiltration using `makecab`, `7zip`, and `rundll32` for minidump creation.