YARA-Regeln mit dem Tag POWERSHELL
4 Regeln tragen den Tag „POWERSHELL“.
Triggers on ISO files that mimick NOBELIUM TTPs, but uses LNK files that call powershell instead.
MalwareSignature Base (Florian Roth / Nextron)· Nils Kuhnert· 2021-06-04Triggers on malicious link files which calls powershell with an obfuscated payload and downloads an HTA file.
MalwareSignature Base (Florian Roth / Nextron)· Nils Kuhnert· 2021-06-04- SECUINFRA_SUSP_Powershell_Download_Temp_RundllNur Metadaten
Detect a Download to %temp% and execution with rundll32.exe
Verdächtig / HuntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02 - SECUINFRA_SUSP_Powershell_Download_Temp_Rundll_1Nur Metadaten
Detect a Download to %temp% and execution with rundll32.exe
Verdächtig / HuntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02