ManualFinder/PDF Editor Malware Hunting Query
This rule detects indicators of compromise (IOCs) associated with the 'ManualFinder/PDF Editor' malware campaign. It identifies malicious activity across multiple data sources, including file hashes, process hashes, suspicious certificate signers, suspicious company names in version info, suspicious file descriptions, malicious command execution, and network connections to known command and control (C2) or malicious PDF-related domains. The rule leverages external data sources for IOCs such as file hashes, C2 domains, PDF-related domains, suspicious signers, and malicious commands. It also includes static IOCs like specific file descriptions and company names. The detection logic is designed to identify various stages of the malware's activity, from initial execution to network communication.
Microsoft Sentinel (KQL)
