MOONRISE RAT Process Hash Match
This rule detects the execution of processes whose SHA256 hash matches a known hash associated with the MOONRISE RAT malware. It queries DeviceProcessEvents for the last 24 hours and filters for processes with matching SHA256 hashes.
Microsoft Sentinel (KQL)
