SLOW#TEMPEST Loader DLL Hash
This rule detects a specific DLL hash (3d3837eb69c3b072fdfc915468cbc8a83bb0db7babd5f7863bdf81213045023c) associated with the SLOW#TEMPEST campaign. This file is the loader DLL responsible for executing the malware's payload. The rule looks for this hash in both executed processes and files on disk.
Splunk (SPL)
