Hacktool - IronSharpPack Execution
Detects the execution of known attacker tools, specifically those associated with the IronSharpPack toolset. This rule identifies process launches where common command and scripting interpreters (cmd.exe, python, ipy.exe, powershell.exe, pwsh.exe, wsl.exe) are used to execute scripts or binaries with names indicative of IronSharpPack components. The presence of these tools in an unauthorized environment suggests malicious activity, often related to offensive security operations, post-exploitation, or privilege escalation.
YARA-L
