TraderTraitor Terraform provider campaign FLATROOF/ROOFDECK MD5 IOC sweep

Arnold Chan@slaz

•updated yesterday•2•0•6

Detects the presence of known MD5 file hashes associated with the TraderTraitor trojanized Terraform provider campaign (also known as FLATROOF/ROOFDECK). The query sweeps DeviceFileEvents, DeviceProcessEvents, and DeviceImageLoadEvents across the last 30 days.