APT37 RubyGems operating_system.rb Hijacking
Detects modifications to the RubyGems 'operating_system.rb' file, a technique used by APT37's SNAKEDROPPER malware to achieve persistence by hijacking the Ruby interpreter's execution flow. The rule specifically looks for file creation or modification events on the 'operating_system.rb' file within the RubyGems directory structure, while excluding legitimate 'gem install' operations to reduce false positives.
Microsoft Sentinel (KQL)
