Potential APT10 (Stone Panda) Malware Execution and Suspicious Process Activity
Detects potential APT10 (Stone Panda) activity by identifying the execution of known remote access tools (RATs) and suspicious use of utilities like WinRAR for password-protected archiving. The rule focuses on processes launched from non-standard directories and unusual parent processes, which may indicate malware execution, lateral movement, or data exfiltration.
Microsoft Sentinel (KQL)
