BRUSHWORM/BRUSHLOGGER Indicators

Daniel Jeremiah@daniyyell

•updated Mar 31, 2026•1•0•32

This rule detects activity associated with BRUSHWORM/BRUSHLOGGER malware. It looks for network connections to the domain 'dawnnewsisl.com' with a URL path containing '/updtdll'. Additionally, it checks for process execution from a specific path pattern (e.g., '\ProgramData\Photoes\Pics\*.exe') or 'rundll32.exe' executing 'C:\Users\Public\Libraries\Recorder.dll'. The combination of these indicators aims to identify high-confidence BRUSHWORM/BRUSHLOGGER activity.