Sha1-Hulud Detection

Vaasudev K@SIEMThatComing

•updated Dec 3, 2025•39•1•389

This rule detects 3 types of suspicious activities: first, the presence of files matching a list of known malicious SHA256 hashes associated with Sha1-Hulud; second, suspicious process behavior involving file deletion commands and third traffic towards potential C2.