Moonrise Malware Detected (Initial execution of powershell)

Luís Marques@remotecodeexecution

•updated Mar 6, 2026•0•43

The rule detects the processes that are executed by the Moonrise malware, which is a backdoor used by the APT29 group. The rule is based on the analysis of the malware's behavior and the processes it creates during execution.