GHOSTBLADE Dataminer Artifacts
Detects process command lines containing strings characteristic of the GHOSTBLADE dataminer, a payload deployed by UNC6353 via the DarkSword exploit. These strings are hardcoded file paths used for data collection and exfiltration.
Sigma
