Dohdoor Malware Hunting Pack

Daniel Jeremiah@daniyyell

•updated Feb 26, 2026•6•0•55

This rule identifies various activities associated with the Dohdoor malware campaign, combining multiple detection heuristics into a single result set. It looks for PowerShell executing curl to download batch scripts, copied Windows tools run from shared folders with unusual arguments, suspicious DLL loads from shared folders, and network connections to C2-style domains identified in the campaign.