PamStealer: Known IOC hunt for Wavel campaign

Arnold Chan@slaz

•updated Sep 25, 2026•0•0•1

Detects execution and network activity related to the PamStealer / Wavel malware campaign, including the JXA dropper and associated C2 infrastructure. The rule monitors for known malicious file hashes (e.g., JXA dropper, pkgunpack utility) and network connections to identified lure, distribution, and C2 domains and URLs used by the campaign.