Detect APT29 WINELOADER Backdoor

Daniel Jeremiah@daniyyell

•updated Aug 3, 2025•1•0•23

Detects APT29's WINELOADER backdoor variant used in phishing campaigns, this rule also detect bad pdf,shtml,htm and vbs or maybe more depends