Kimsuky NUKESPED JSE Loader - certutil base64 decode from ProgramData
Detects high-cardinality, multi-protocol network scanning behavior characteristic of the JDY botnet. The rule identifies internal hosts attempting to connect to a high volume of unique external destinations across multiple protocols with low average bytes per connection, indicative of automated discovery or probing activity.
Splunk (SPL)
