Potential FIN7 Related PowerShell Script Creation
This rule detects the creation of PowerShell script files with specific filenames or suffixes that have been observed in campaigns attributed to the FIN7 threat group. Specifically, it looks for files ending with '_64refl.ps1' or named 'host_ip.ps1'. These patterns are indicative of PowerShell scripts used by FIN7 for various malicious activities, including execution and potentially reflective loading.
Sigma
