Bonadan Actor Command Line Activity
Detects command line patterns associated with the threat actor Bonadan (also known as APT27, Emissary Panda, Lucky Mouse, Bronze Union, G0065). This rule identifies the use of certutil for decoding payloads, wmic for process creation, and schtasks for persistence in suspicious directories.
SentinelOne
