Shadow Reactor Process Chain
Detects the SHADOW#REACTOR process execution chain of wscript.exe spawning powershell.exe, which in turn spawns MSBuild.exe.
YARA-L
Detects the SHADOW#REACTOR process execution chain of wscript.exe spawning powershell.exe, which in turn spawns MSBuild.exe.
Already have an account?