Hijack Loader Lumma Campaign

Daniel Jeremiah@daniyyell

•updated Feb 26, 2026•0•45

This rule detects artifacts associated with the RenEngine, HijackLoader, and Lumma campaigns. It identifies these threats through a combination of specific MD5 hashes, high-signal domain markers (both distribution and C2 domains), and unique filenames. The rule triggers if a file's MD5 hash matches one of the known malicious hashes, or if it contains at least one specific filename in conjunction with at least one domain marker, or if it contains at least two distinct domain markers (either distribution or C2).