APT28 Swallowtail IOC sweep: HOOKEDGE, LegionRelay IPs and webhook.site GUIDs

Arnold Chan@slaz

•updated 2 days ago•0•0•0

Detects network connections, process command-line executions, and email URL info matching known APT28 (Swallowtail, HOOKEDGE, LegionRelay) indicators of compromise, including specific IP addresses and GUIDs.