UNC1549 cmd.exe chained execution of MiniJunk/MiniBrowse payload stages
Detects suspicious command-line execution of cmd.exe involving specific patterns like 'MiniJunk' or 'MiniBrowse', or command-line activity spawned from common file types (e.g., .exe, .doc, .pdf, .zip). This rule is designed to identify potential multi-stage payload execution or malicious dropper activity associated with the UNC1549 threat actor.
Splunk (SPL)
