Shadow Campaigns TGR-STA-1030 Activity
This rule detects activities associated with the "Shadow Campaigns" espionage operation. It identifies the "Diaoyu loader" through specific command-line arguments, C2 communication with known malicious domains, and the deployment of webshells (Behinder, Neo-reGeorg, Godzilla, reGeorg) originating from common web server processes (w3wp.exe, httpd.exe, nginx.exe, java.exe).
Microsoft Sentinel (KQL)
