UNC3569 GRAYRABBIT Staged Payload Retrieval from Alibaba Cloud Staging Server 8.218.50.207
Detects HTTP traffic involving the retrieval of 7z.exe or 7zp.dll payloads from a known Alibaba Cloud staging server associated with the UNC3569 threat actor and the GRAYRABBIT malware. The rule uses a threshold-based detection to identify repeated download attempts from the external IP 8.218.50.207.
Suricata
