Detections
TerminalFix campaign deploys a reverse tunnel through multistage intrusion
Public event hunting query
spl
· Evidence-linked query artifact; local execution not performed.
index=* ("TerminalFix" OR "campaign") | stats count by host, user, process_name