Lace Tempest Malware Loader Execution

SigmaHQ Detections@sigmaHQ

•updated Oct 1, 2024•0•40

Detects the execution of a specific binary identified by its filename and SHA256 hash. This binary is associated with the Lace Tempest threat group and is used to load additional malware, as reported by the SysAid Team. The detection specifically looks for a process created from the path ':\Program Files\SysAidServer\tomcat\webapps\usersfiles\user.exe' or a process with the SHA256 hash 'B5ACF14CDAC40BE590318DEE95425D0746E85B1B7B1CBD14DA66F21F2522BF4D'.