Kimsuky APT MD5 Hash Match in File or Process Events
Detects the creation, modification, or execution of known malicious files associated with the Kimsuky threat actor, based on a static list of MD5 hashes observed in their campaigns.
Microsoft Sentinel (KQL)
