Malicious Use of Post-Exploitation Tools by CL-CRI-1040/Storm-2603
Detects the execution of legitimate or dual-use tools commonly used by the CL-CRI-1040/Storm-2603 actor for post-exploitation activities like credential dumping, reconnaissance, and lateral movement. The rule attempts to reduce false positives by looking for execution from unusual paths or by suspicious parent processes.
Microsoft Sentinel (KQL)
