Detect Kimsuky PowerShell Exfiltration to private Github repositories as attack infrastructure (PAT)

Chaitanya B B@mralien

•updated Jul 15, 2025•2•5•72

Detects PowerShell activity associated with the Kimsuky threat actor, where system information is collected and exfiltrated to a private GitHub repository, or where other IOCs related to this campaign are observed. This technique was observed in a campaign distributing the XenoRAT malware.