Lace Tempest PowerShell Evidence Eraser

SigmaHQ Detections@sigmaHQ

•updated Oct 1, 2024•1•0•34

Detects a PowerShell script used by Lace Tempest APT to erase evidence from victim servers by exploiting CVE-2023-47246 as reported by SysAid Team. The script specifically targets files related to 'usersfiles.war' and 'SysAidServer' within a Tomcat directory, indicating an attempt to clean up traces of an intrusion or exploit.