AhsayCBS campaign IOC sweep (CVE-2026-105133/105134, XMRig)
This rule detects indicator of compromise (IOC) sweep events associated with the AhsayCBS campaign (CVE-2026-105133 and CVE-2026-105134) involving XMRig cryptominer activity. It checks for specific file and process SHA256 hashes, remote IP addresses, and domain connections related to known mining pools or attacker infrastructure using Sentinel Device tables.
Microsoft Sentinel (KQL)
