APT28 NotDoor Known Malware Hash Detection (SimpleLoader/SSPICLI/EhStoreShell/VbaProject)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•0

This rule monitors for the execution of files or processes matching known file hashes associated with the APT28 (Fancy Bear/Strontium) threat group, specifically detecting SimpleLoader and various NotDoor components.