NightLedger C2 Command Dispatcher - AppVShNotify.exe Implant Host Executing Process/DLL/Kill/Thread Commands
Detects NightLedger backdoor command dispatcher invoking known command IDs for process execution (3), DLL loading (43), process termination (56), and thread termination (69) as parsed from its C2 channel. When the dispatching process is AppVShNotify.exe, these actions are common to legitimate App-V activity, so the rule only fires for that image when there is additional evidence it is the compromised implant host - either recorded process lineage (ParentImage) or image-load context showing a module already loaded into the process (ImageLoaded). Events for AppVShNotify.exe lacking both signals are suppressed as likely benign generic process control.
Microsoft Sentinel (KQL)
