HijackLoader (IDAT Loader) process injection/hollowing delivering Vidar v2.0/v2.1 (Operation Turb00)
This rule detects potential process injection activities associated with the HijackLoader (IDAT Loader) malware family. It monitors Sysmon event logs for sequences involving process creation, image loading, and inter-process manipulation, specifically flagging the use of CreateRemoteThread, QueueUserAPC, and process access patterns (such as writing thread rights) indicative of reflective DLL injection used to deliver payloads like Vidar.
Splunk (SPL)
