SLOW#TEMPEST Payload DLL Hash

R W@shiftyroot

•updated Jul 23, 2025•0•19

This rule detects a specific DLL hash (3583cc881cb077f97422b9729075c9465f0f8f94647b746ee7fa049c4970a978) associated with the SLOW#TEMPEST campaign. This file is a DLL that contains an encrypted payload. The rule searches for this hash in both executed processes and files on disk.