Russian Panda Payload Hash Detection

Bhojraj Joshi@cybrbhojrajjoshi

•updated Apr 23, 2026•0•131

This rule detects the execution or writing of a file with a specific SHA256 hash associated with the 'GateKeeper' payload. It monitors process creation events, new executable writes, PE file writes, and image loads on Windows platforms to identify the presence and activity of this known malicious file.