APT28 Operation Phantom Net Voxel - Multi-Rule Detection
This rule set detects various components associated with APT28's 'Operation Phantom Net Voxel'. It includes rules for the BeardShell C++ backdoor, a steganography loader DLL (prnfldr.dll), Covenant HTTP Grunt activity using Koofr for C2, and several VBA macro variants. The VBA macros are designed to drop and execute components, interact with images for steganography, use ADODB.Stream for file operations, and interact with kernel32 and advapi32 APIs for process creation and registry manipulation.
YARA
