Evasive Panda APT Activity
This rule detects activities associated with the Evasive Panda APT, specifically looking for network connections to known malicious IP addresses, the creation or modification of specific files and processes related to 'sohuva_update' and 'evteng.exe' in 'Microsoft\MF' or 'Microsoft\eHome' directories, and network connections to specific URLs containing 'dictionary.com' or 'p2p.hd.sohu.com' patterns. These indicators are linked to the MgBot malware and DNS poisoning tactics used by the Evasive Panda APT group.
Microsoft Sentinel (KQL)
