PhantomRelay RAT Fingerprint Script Execution
Detects the execution of the initial fingerprinting PowerShell script utilized by the PhantomRelay RAT. PhantomRelay is a custom Remote Access Trojan associated with the Russia-nexus threat group GREYVIBE. The script gathers system information such as computer name, username, and PID, using a hardcoded User-Agent string before connecting to the C2 server.
Sigma
