GraphWorm Builds a Victim ID from Hardware Attributes

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•2

Detects a backdoor querying adapter IP, processor ID, and device serial values in one sequence to derive a unique cloud folder identifier. This rule specifically looks for command-line executions of wmic, powershell, or cmd that contain strings related to Win32_NetworkAdapter, ProcessorId, SerialNumber, Win32_PhysicalMedia, or MACAddress.