Règles YARA avec le tag CHARMINGKITTEN

Detects PowerStar decrypt function, potentially downloaded standalone and then injected.

Detects LNK command line used to install PowerStar.

Detects interesting log message embedded in memory only version of PowerStar.

Detects the batch script used to persist PowerStar via Startup.

Custom PowerShell backdoor used by Charming Kitten.

Detects the initial stage of the memory only variant of PowerStar.