Lazarus Graphalgo/GHAPPIER IOC sweep across file, process, network telemetry

Arnold Chan@slaz

•updated Sep 28, 2026•0•0•5

This rule performs an indicator of compromise (IOC) hunt for artifacts related to the Lazarus Group's Graphalgo/GHAPPIER campaign. It monitors DeviceFileEvents, DeviceProcessEvents, and DeviceNetworkEvents over the past 90 days to identify matches against known malicious file hashes (SHA256/SHA1), command-and-control (C2) IP addresses, and malicious domains associated with this campaign.