KREMLIN multi-stage loader/installer hash execution

Ankit Mehta@Secvyn

•updated Sep 16, 2026•1•0•3

Detects the execution or invocation of processes matching a known list of malicious file hashes (SHA256). The rule monitors both direct execution (SHA256) and instances where a malicious file acts as an initiating process.