DeadVax Payload in IntelDriver
Malware often hides its payload in folders that look legitimate. In this case, it uses a path that sounds like an Intel driver folder, but it is fake. A real Intel installer would use a different, standard path. What makes this suspicious is that the file is created by a script, such as PowerShell or a batch file, not by an installer. Normal software installs show a setup wizard and write to known locations. Here, a script writes a file with an unusual name to a folder that mimics a trusted vendor. Security teams should treat any file created in this path by a script as highly suspicious. This rule helps catch that behaviour early in the attack.
Sigma
