• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    UNC7017 AOMEI supply chain IOC sweep (URLs, domains, C2 IP, SHA256)

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Arnold Chan@slaz
    •updated 11 days ago•0•0•3

    Detects network connections, process executions, file creations, and image loads associated with the UNC7017 AOMEI supply chain campaign IOC sweep, including specific malicious URLs, domains, IPs, file paths, and hashes.

    Microsoft Sentinel (KQL)

    Tags

    T1195 - Supply Chain CompromiseTA0001 - Initial AccessNetwork ConnectionFile CreationFile DownloadImage LoadCommand ExecutionWindowsWindows Defender Atpkql

    Found in

    • UNC7017 Ephemeral Supply Chain Tampering CampaignLast updated 11 days ago
    • UNC7017 Ephemeral Supply Chain Tampering CampaignLast updated 11 days ago
    • UNC7017 Ephemeral Supply Chain Tampering CampaignLast updated 11 days ago
    • UNC7017 Ephemeral Supply Chain Tampering CampaignLast updated 11 days ago
    • UNC7017 Ephemeral Supply Chain Tampering CampaignLast updated 11 days ago

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?