DeadVax IPFS VHD Download and Script Execution
This attack starts when a user clicks a link in an email or message. The link opens what looks like a document, such as a purchase order or PDF. In reality, it is a fake file that runs a script when opened. The script then loads the malware. The activity is started from the browser or file explorer, which is normal for a user opening a file. But the combination of opening a document and then immediately running a script is suspicious. Legitimate documents do not run scripts when you open them. Security teams should look for cases where a user opens a file from a link and that file starts a script process. This rule helps catch that first step of the attack.
Sigma
