Kongtuke Powershell Loader
This rule detects the KongTuke second-stage PowerShell loader. It specifically looks for PowerShell scripts that attempt to read a payload from a file named 'Remove-NetNatStaticMapping.log', decrypt it using DPAPI (Data Protection API) via 'ProtectedData]::Unprotect' and 'DataProtectionScope]::Localmachine', and then execute the decrypted content using an 'iex' alias. The script also includes references to 'Add-Type -AssemblyName System.Security' and 'AppActions', indicating advanced PowerShell capabilities and potential interaction with application-related data. The use of 'ReadAllBytes' and 'UTF8.GetString' suggests the payload is read as raw bytes and then converted to a string for execution.
YARA
