Règles YARA avec le tag DOWNLOAD
4 règles portent le tag « DOWNLOAD ».
- SECUINFRA_SUSP_Discord_Attachments_URLMétadonnées seules
Detects a PE file that contains an Discord Attachments URL. This is often used by Malware to download further payloads
Suspect / chasseSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-19 - SECUINFRA_SUSP_Powershell_Download_Temp_RundllMétadonnées seules
Detect a Download to %temp% and execution with rundll32.exe
Suspect / chasseSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02 - SECUINFRA_SUSP_Powershell_Download_Temp_Rundll_1Métadonnées seules
Detect a Download to %temp% and execution with rundll32.exe
Suspect / chasseSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02 - SECUINFRA_SUSP_DOTNET_PE_Download_To_SpecialfolderMétadonnées seules
Detects a .NET Binary that downloads further payload and retrieves a special folder
Suspect / chasseSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27