RoguePlanet: BlueHammer/RedSun/Bluekit Deployment via Exploitarium Harness
Detects the presence and execution of components associated with the 'Exploitarium' toolkit, a collection of exploit harnesses and proofs-of-concept. The rule monitors for process execution of specific filenames, file creation events, persistence via registry-based service installation, and image loads related to the toolkit's binaries.
Microsoft Sentinel (KQL)
