Operation Poisson PhantomBackdoor/TencShell persistence via senti.dll and Run key

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

This rule detects various activities associated with suspicious implants, including file creation/execution, process execution, DLL loading (potential injection), and persistence via Run registry keys. It specifically looks for files named 'senti.dll', 'Thal.exe', and mentions 'PhantomBackdoor' and 'TencShell' as suspicious artifacts.