Règles YARA avec le tag POWERSHELL
4 règles portent le tag « POWERSHELL ».
Triggers on ISO files that mimick NOBELIUM TTPs, but uses LNK files that call powershell instead.
MalwareSignature Base (Florian Roth / Nextron)· Nils Kuhnert· 2021-06-04Triggers on malicious link files which calls powershell with an obfuscated payload and downloads an HTA file.
MalwareSignature Base (Florian Roth / Nextron)· Nils Kuhnert· 2021-06-04- SECUINFRA_SUSP_Powershell_Download_Temp_RundllMétadonnées seules
Detect a Download to %temp% and execution with rundll32.exe
Suspect / chasseSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02 - SECUINFRA_SUSP_Powershell_Download_Temp_Rundll_1Métadonnées seules
Detect a Download to %temp% and execution with rundll32.exe
Suspect / chasseSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02