Exploitarium libpwn/BlueHammer/RedSun/Bluekit post-exploitation staging
This rule detects the presence of files and processes associated with the 'Exploitarium' proof-of-concept (PoC) toolset. It monitors for specific filenames, process names, and path patterns linked to known harnesses, exploit scripts, and malware families commonly associated with the repository.
SentinelOne
