DPRK NPM Infostealer Keyboard Data Exfiltration Endpoint
Detects HTTP POST requests directed to the specific URI path '/api/validate/keyboard-events', which is used by a North Korean-linked npm malware to exfiltrate keylogger data.
Sigma
Detects HTTP POST requests directed to the specific URI path '/api/validate/keyboard-events', which is used by a North Korean-linked npm malware to exfiltrate keylogger data.
Already have an account?