CVE-2026-1731 Malware Hashes Detection
Detects the creation of files matching SHA256 hashes of known malware (SparkRAT, VShell, webshells) observed in the CVE-2026-1731 exploitation campaign. This rule specifically looks for file creation events where the SHA256 hash of the created file matches one of the predefined malware hashes.
Microsoft Sentinel (KQL)
