Kimsuky Dead Drop Resolver GET to raw.githubusercontent.com main branch

Ibrahim Saud@tektrix

•updated 14 days ago•1•1•5

This rule detects network requests directed at raw.githubusercontent.com that attempt to retrieve 'init.dat' or files named with a specific GUID format, patterns which are characteristic of the Kimsuky threat group using GitHub as a dead drop resolver for C2 infrastructure discovery.