Malicious NuGet Campaign File Hashes Detected
Detects file creation or process execution events involving the SHA256 hashes of malicious DLLs from the NCryptYo, DOMOAuth2_, IRAOAuth2.0, and SimpleWriter_ NuGet packages. This rule identifies the presence or execution of known malicious components associated with a supply chain compromise targeting ASP.NET developers.
Microsoft Sentinel (KQL)
