UNC6240 ShinyHunters PeopleSoft campaign IOC hunt (hashes, C2 IPs, domains)
This rule performs a retrospective search across device file and network events for indicators of compromise associated with the UNC6240/ShinyHunters actor's activity against PeopleSoft, specifically linked to CVE-2026-35273. It monitors for known malicious file hashes (JSP webshells and executables), connections to known C2 infrastructure, and DNS lookups for specific malicious domains.
Microsoft Sentinel (KQL)
