GREYVIBE LegionRelay PowerShell Script Execution
Detects the execution of the LegionRelay client script, a PowerShell RAT utilized by the Russia-nexus threat group GREYVIBE. LegionRelay communicates with its command-and-control server via REST API methods and relies on operator-staged scripts for post-compromise activity. The detection matches on specific REST API paths and PowerShell artifacts found within the script block.
Sigma
