All Detections

PhantomPulse Payload Check URI

avatar
Elgonad .@elgonad
updated Apr 14, 202650295

Monitors for the specific URL pattern used by the PhantomPull loader to fetch the final PhantomPulse payload via WinHTTP. This behavior is associated with the REF6598 campaign.

Sigma