FoxKitsune Malware Activity Detection

michael lohn@mlohn1984

•updated Feb 18, 2026•21•1•148

This rule detects various activities associated with the FoxKitsune malware, including network staging, suspicious file drops in SysWOW64, unusual svchost execution, service persistence, and attempts to tamper with Windows Defender. It correlates these events to identify potential FoxKitsune infections.