BlueHammer/RedSun/Bluekit/UnDefend Malware Deployment - RoguePlanet Campaign
This rule monitors system activity for the presence of specific file names, paths, and image loads associated with known malware families, specifically BlueHammer, RedSun, UnDefend, Bluekit, and libpwn. The rule evaluates process creation, file creation, and DLL load events across EDR and endpoint logs to identify potentially malicious indicators.
Splunk (SPL)
