All Detections

Unc6201 Dell Recoverpoint Persistence

avatar
Daniel Jeremiah@daniyyell
updated Feb 20, 2026033

Detects modification of the 'convert_hosts.sh' script on Dell RecoverPoint appliances. This technique is used by UNC6201 to establish persistence for the GRIMBOLT and BRICKSTORM backdoors.

YARA-L