Lucky Mouse: Incident Response to Detection Engineering

This blogpost reviews an Intrinsec incident attributed to APT27 (Lucky Mouse) and provides SIGMA/ECS-based detection logic and telemetry notes for key attacker techniques—command execution via wmiexec/wmic, PowerShell disabling of Windows Defender, Exchange mailbox export, credential dumping via ProcDump and ntdsutil, RAR-based archiving/encryption, and Chisel SOCKS tunneling—along with practical false-positive mitigations and rule-tuning guidance.