Storm-2561 Malicious File Hash Detection
This rule detects the presence of malicious files associated with the Storm-2561 threat actor by matching their SHA-256 hashes. The rule specifically targets files on Windows operating systems and also filters for files signed by "Taiyuan Lihua Near Information Technology Co., Ltd.", which is known to be associated with these malicious activities. The detected files include ZIP archives, MSI installers, DLLs, and fake VPN executables.
Cortex XDR
