Potential Goofy Guineapig Backdoor Command Execution
Detects a specific broken command line argument 'choice /t %d /d y /n >nul' used by the Goofy-Guineapig backdoor, as detailed in the NCSC report. This command is likely an attempt to introduce a delay or interact with a prompt in a non-standard way, which could indicate malicious activity.
Sigma
