KREMLIN CAB archive staging file (Ethereum transition campaign)

Ankit Mehta@Secvyn

•updated Sep 16, 2026•0•0•1

This rule detects the presence or execution of a specific CAB file identified by its SHA256 hash. It monitors both file creation/access events and process execution events involving this hash, indicating potential malicious activity involving a known malicious cabinet file.