YARA rules tagged POWERSHELL
4 rules carry the tag “POWERSHELL”.
Triggers on ISO files that mimick NOBELIUM TTPs, but uses LNK files that call powershell instead.
MalwareSignature Base (Florian Roth / Nextron)· Nils Kuhnert· 2021-06-04Triggers on malicious link files which calls powershell with an obfuscated payload and downloads an HTA file.
MalwareSignature Base (Florian Roth / Nextron)· Nils Kuhnert· 2021-06-04- SECUINFRA_SUSP_Powershell_Download_Temp_RundllMetadata only
Detect a Download to %temp% and execution with rundll32.exe
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02 - SECUINFRA_SUSP_Powershell_Download_Temp_Rundll_1Metadata only
Detect a Download to %temp% and execution with rundll32.exe
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02