ShinyHunters AryStinger/JDY secondary payload on PeopleSoft host
Detects execution of AryStinger or JDY malware as a secondary payload on Oracle PeopleSoft servers, likely following exploitation of CVE-2026-35273 by ShinyHunters. The rule monitors for processes matching these names or anomalous binaries spawned from within the PeopleSoft application directory that are not part of the legitimate application service suite.
YARA-L
