RunPE Loader Execution Preceding PULSAR/REMCOS Payloads
This rule monitors for the presence of files matching a known list of malicious SHA256 hashes on devices. It correlates these file events with process creation events occurring on the same device within a 10-minute window, identifying potential execution of malicious binaries or artifacts.
Microsoft Sentinel (KQL)
