CloudZ and Pheno Malware Activity Detection

Daniel Jeremiah@daniyyell

•updated May 7, 2026•3•0•187

This rule detects various activities associated with CloudZ and Pheno malware, including persistence mechanisms via scheduled tasks, execution of .NET loaders (regasm.exe), payload downloads using common utilities (curl, powershell, bitsadmin) from known staging patterns, reconnaissance artifacts, and network connections to known CloudZ infrastructure.