SPECTRALVIPER Configuration File Creation
Detects the creation of hidden configuration files (e.g., .sv_config.json) in hidden directories, indicating the installation or configuration phase of the SPECTRALVIPER backdoor. The rule specifically looks for files created in a directory matching the pattern `/.config/spectralviper/` or files named `.sv_config.json`.
Microsoft Sentinel (KQL)
