cyber freak
@cyberfreak0 followers4 downloads8 copies0 likes203 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
1
1
1
Platforms
1
Products / Services
1
MITRE Techniques
1
1
1
1
1
This rule hunts for various artifacts and behaviors associated with the APT28 campaign "Phantom Net Voxel", which leverages COM hijacking, steganography, and cloud services for C2. This version is specifically tailored for Azure Sentinel using only DeviceProcessEvents, DeviceFileEvents, and DeviceNetworkEvents. It detects known malicious file hashes, regsvr32 execution of a specific DLL, Office applications dropping malicious DLLs or steganographic PNGs, C2 communications to known cloud storage domains, creation of SlimAgent log files, and explorer.exe accessing steganographic PNG files indicating successful COM hijacking.
