DAYLIGHT Obfuscator Artifacts In PowerShell
Detects the execution of PowerShell scripts containing strings associated with the DAYLIGHT obfuscator. This obfuscator is utilized by the Russia-nexus threat group GREYVIBE to hide post-compromise payloads and PhantomRelay implants.
Sigma
