Screening Serpens AppDomainManager Hijack Config Staging
Detects the creation of specific .NET configuration files (.config) used by Screening Serpens for AppDomainManager hijacking, alongside known malicious DLLs. This rule correlates the creation of the campaign's specific config file names with the deployment of its associated payloads in the same folder within a short time frame.
Microsoft Sentinel (KQL)
