HazyBeacon Backdoor Activity

Aaron Mog@AaronMogS2S

•updated Jul 14, 2025•0•29

Detects TTPs associated with the HazyBeacon backdoor, which has been observed targeting governmental entities in Southeast Asia. This rule identifies specific service creation for persistence, DLL sideloading of mscorsvc.dll, C2 communication via AWS Lambda URLs, and execution of known exfiltration tools from the C:\ProgramData directory.