Ebury multi-type IOC sweep (IPs, filename, empty-guarded hash/domain/URL/email)

Arnold Chan@slaz

•updated yesterday•1•0•2

Detects known Indicators of Compromise (IOCs) associated with the Ebury Linux backdoor, including specific file hashes, implants like libkeyutils.so.1.10.2, malicious IP connections, and associated network/email artifacts using Microsoft Defender XDR advanced hunting.