PoeLLM Canto Incognito IOC sweep (C2 IPs, Kryptex pool, libgcrypt SHA256)
This rule performs an IOC sweep over the past 30 days using DeviceNetworkEvents, DeviceFileEvents, and DeviceProcessEvents to detect indicators associated with PoeLLM / Canto Incognito malware campaigns, specifically scanning for known C2 IP addresses, Kryptex cryptomining pool endpoints/domains, and specific file hashes (SHA256).
Microsoft Sentinel (KQL)
