All Detections

Kazuar - Dynamic API Resolution (LdrGetProcedureAddress) (T1106)

avatar
Ibrahim Saud@tektrix
updated Jun 21, 2026001

Detects the Kazuar botnet executing dynamic API resolution (API hashing) followed by CreateRemoteThread into explorer.exe to hide its execution.

Microsoft Sentinel (KQL)