HoneyMyte Post-Exploitation Script Behavior
This rule detects behaviors associated with HoneyMyte post-exploitation scripts. Specifically, it looks for `curl.exe` or `curl` being used to download executables or files into 'Libraries' or 'Public' directories. It also identifies executables named `getlogindata.exe` or `getlogindataedge.exe` when their command line arguments contain 'Login Data' or 'Local State', indicating browser credential theft. Additionally, it detects `powershell.exe` or `cmd.exe` command lines that include keywords related to HoneyMyte's exfiltration methods (e.g., 'pixeldrain', 'PIXELDRAIN', '113.23.212', 'log.dat', 'nbtscan').
Sigma
