Lace Tempest PowerShell Loader Activity

SigmaHQ Detections@sigmaHQ

•updated Oct 1, 2024•0•32

Detects a PowerShell script used by the Lace Tempest APT group to launch their malware loader by exploiting CVE-2023-47246. The script contains specific strings related to the SysAid server path, the execution of 'user.exe', and the removal of temporary files.