YARA rules tagged CHARMINGKITTEN
6 rules carry the tag “CHARMINGKITTEN”.
Detects PowerStar decrypt function, potentially downloaded standalone and then injected.
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-05-16Detects LNK command line used to install PowerStar.
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-05-16Detects interesting log message embedded in memory only version of PowerStar.
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-05-16Detects the batch script used to persist PowerStar via Startup.
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-05-16Custom PowerShell backdoor used by Charming Kitten.
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2021-10-13Detects the initial stage of the memory only variant of PowerStar.
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-05-16