Peach Sandstorm APT Command Line Indicator

SigmaHQ Detections@sigmaHQ

•updated Dec 1, 2024•0•29

Detects process creation activity related to the Peach Sandstorm APT, specifically looking for a unique string 'QP's\*(58vaP!tF4' in the command line. This string is likely a unique identifier or a specific parameter used by the APT's tools.