Rokarolla Banking Trojan Detection by SHA-256 File Hash
This rule monitors for the presence of specific, known malicious file hashes associated with the Rokarolla threat actor. It correlates both file system activity and antivirus detections across the environment to identify and alert on potential execution or storage of these malicious artifacts.
Microsoft Sentinel (KQL)
