MovieReaper File Manager Module: Masqueraded msedge.exe and C2 Activity

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•1

This rule detects potentially malicious activity by monitoring for a specific executable file name ('msedge.exe') located in a non-standard path ('ProgramData'), as well as network connections to a known malicious IP address ('193.23.118.155') and DNS requests for a domain associated with suspicious activity ('deadhub.org').