PhantomPulse Payload Check URI
This rule detects the specific command and control check-in format used by the PhantomPull loader to retrieve the final PhantomPulse payload. It monitors for a unique URL pattern in process command lines, indicating communication with the PhantomPulse C2 server.
CQL
