YARA · SecuInfra Falcon Team

SECUINFRA_SUSP_DOTNET_PE_Download_To_Specialfolder

Detects a .NET Binary that downloads further payload and retrieves a special folder

What this rule detects

Detects a .NET Binary that downloads further payload and retrieves a special folder

Targets: Windows PE.

It defines 3 patterns (3 text, 0 hex, 0 regex). YARA modules used: pe.

YARA-X says: warning[non_bool_expr]: non-boolean expression used as boolean

Summary generated from the rule's metadata and condition.

Rule text not reproduced

Author: SECUINFRA Falcon Team

Source repository: SecuInfra Falcon Team @ 2d7c66d7d1

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 106683bf-1d36-58ee-b5af-4723aa70fdad

SECUINFRA_SUSP_Discord_Attachments_URLMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-19
SECUINFRA_SUSP_Powershell_Download_Temp_RundllMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02
SECUINFRA_SUSP_Powershell_Download_Temp_Rundll_1Metadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02
SECUINFRA_SUSP_DOTNET_PE_List_AVMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
SECUINFRA_OBFUS_Powershell_ExecutionMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02
SECUINFRA_OBFUS_Powershell_Replace_TildeMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-10-02
SECUINFRA_OBFUS_VBS_Reverse_StartupMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
SECUINFRA_SUSP_LNK_Staging_DirectoryMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27