Muddled Libra Tool Execution Detection
Detects the execution or presence of files associated with the Muddled Libra threat actor's toolkit. This includes tools for tunneling (Chisel), Active Directory reconnaissance (ADRecon, ADExplorer), and the initial tool archive (goon.zip). The rule identifies process execution by hash, filename, or command line arguments, and file creation events for specific hashes.
Microsoft Sentinel (KQL)
