Lunex campaign IOC sweep across file, process, and network telemetry

Arnold Chan@slaz

•updated Sep 27, 2026•1•0•13

This rule monitors for indicators of compromise (IOCs) associated with the Lunex Malware-as-a-Service (MaaS) campaign. It aggregates telemetry from file creation, process execution, and network connections to identify the presence of known malicious hashes, C2 IP addresses, phishing-related domains, and specific payload URLs.