Storm-2561 - High-Entropy Persistence Directory (T1036.005)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•1

Hunts for the fake VPN creating highly randomized, high-entropy directories in %AppData% to store its persistence binaries. This rule specifically looks for folder creation events in the AppData\Roaming directory with a highly randomized, 12 or more character alphanumeric name, and correlates it with a process event from either GlobalProtect or AnyConnect VPN clients.