Diamond Sleet APT Process Activity Indicator
This rule detects process creation events where the command line contains a specific, unique string ' uTYNkfKxHiZrx3KJ'. This string is identified as an indicator of compromise associated with the Diamond Sleet APT group, also known as Lazarus Group. The rule aims to identify execution of malicious payloads or commands used by this threat actor.
Sigma
