YARA rules tagged SCRIPT

Detects suspicious command line combinations often found in post exploitation activities

Detects forensic artifacts found in attacks on SysAid on-prem software exploiting CVE-2023-47246

Detects indicators found in logs during and after Cleo software exploitation (as reported by Huntress in December 2024)

Detects encoded and decoded PowerShell loader used during Cleo software exploitation (as reported by Huntress in December 2024)

Detects suspicious base64 encoded shell commands used for downloading and executing further stages

Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)

Detects forensic artifacts found in the exploitation of CVE-2023-2868 in Barracuda ESG devices by UNC4841

Detects successful ProxyNotShell exploitation attempts in log files (attempt to identify the attack before the official release of detailed information)

Detects post exploitation indicators observed by HuntressLabs in relation to the ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability that allows an Authentication Bypass

Detects forensic artefacts related to exploitation activity of SAP NetWeaver CVE-2025-31324

Detects forensic artefacts related to exploitation activity of SAP NetWeaver CVE-2025-31324

Detects forensic artefacts of APT UTA028 as found in a campaign exploiting the Palo Alto CVE-2024-3400 vulnerability

Detects suspicious PowerShell command that downloads content from transfer.sh as often found in loaders

Detects output generated by the command line port scanner FScan

Detects suspicious one-liner to spawn a shell using Python

Detects command line parameters often used by crypto mining software

Detects successful ProxyShell exploitation attempts in log files

Detects suspicious file path pointing to the root of a folder easily accessible via environment variables