KREMLIN persistence script execution (SHA256 match)

Ankit Mehta@Secvyn

•updated Sep 16, 2026•0•0•1

This rule monitors for process execution and file activity associated with a specific file hash known to be malicious. By tracking both process and file events using a SHA256 identifier, it captures when a specific threat artifact is executed or interacted with on a system.