Detect DeadVax Self-Parsing Loader
In this attack, malware uses a renamed copy of PowerShell to read a hidden file and run it. The file contains more malware that gets executed in memory. What makes this suspicious is that the activity is started by a batch or command script, not by the user directly. A normal user would run programs by double-clicking or from a menu. Here, one script launches another, which then reads and runs hidden content. This is a common pattern in multi-stage attacks where each step hides the next. Security teams should look for this chain: a batch or command window starts a process that reads a specific file and executes what it finds. This rule helps catch that behaviour before the full malware takes over.
Sigma
