GHAPPIER/PolinRider IOC sweep: domains, IPs, URLs, and file hashes
This rule monitors for network connections to known malicious domains and IP addresses, as well as the presence or execution of files with specific SHA256 hashes known to be associated with threat activity. The indicators focus on Vercel-hosted domains and specific file hashes linked to recent campaign activity.
Microsoft Sentinel (KQL)
