Possible Detection of MSIX Payloads via Google Ad (via cmdline)

Zy Dnz@zydnz

•updated Oct 9, 2025•3•1•90

This rule aimed to detect NetSupport RAT via MSIX app installer files. Attackers use csvde.exe to collect target device informations such as ip and accountname. They put outputs to the file (-f). And then send it to the attacker.