Ebury multi-type IOC sweep (IPs, filename, empty-guarded hash/domain/URL/email)
Detects known Indicators of Compromise (IOCs) associated with the Ebury Linux backdoor, including specific file hashes, implants like libkeyutils.so.1.10.2, malicious IP connections, and associated network/email artifacts using Microsoft Defender XDR advanced hunting.
Microsoft Sentinel (KQL)
