Reglas YARA con la etiqueta POWERSHELL
4 reglas llevan la etiqueta «POWERSHELL».
Triggers on ISO files that mimick NOBELIUM TTPs, but uses LNK files that call powershell instead.
MalwareSignature Base (Florian Roth / Nextron)· Nils Kuhnert· 2021-06-04Triggers on malicious link files which calls powershell with an obfuscated payload and downloads an HTA file.
MalwareSignature Base (Florian Roth / Nextron)· Nils Kuhnert· 2021-06-04- SECUINFRA_SUSP_Powershell_Download_Temp_RundllSolo metadatos
Detect a Download to %temp% and execution with rundll32.exe
Sospechoso / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02 - SECUINFRA_SUSP_Powershell_Download_Temp_Rundll_1Solo metadatos
Detect a Download to %temp% and execution with rundll32.exe
Sospechoso / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02