RenEngine Campaign with HijackLoader
This rule detects indicators associated with the RenEngine campaign, which involves the deployment of HijackLoader, Lumma Stealer, and ACR Stealer. Detection is based on specific MD5 hashes of known malicious files, filenames used in the campaign, and command and control (C2) domains identified as part of the infrastructure.
Splunk (SPL)
