UNC4841 - Potential SEASPY Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•25

This rule detects the execution of specific binaries identified as being used by the UNC4841 threat group to deploy the SEASPY backdoor. The binaries include 'BarracudaMailService', 'resize2fstab', and 'resize_reisertab'. Detection is based on the image path ending with any of these specific names.