Ghostcontainer Net Backdoor Assembly

Arnold Chan@slaz

•updated 23 days ago•0•0•2

Detects the GhostContainer .NET-based backdoor assembly deployed on compromised Microsoft Exchange servers, requiring multiple corroborating unique indicators (C2 header, proxy class name, virtual path parameters) alongside .NET/PE structure to reduce false positives