Coruna Exploit Kit JavaScript Obfuscation Patterns
This rule detects specific JavaScript obfuscation patterns used by the Coruna exploit kit framework. The kit was observed being used by multiple threat actors, including UNC6353 and UNC6691. The rule looks for two distinct patterns in process command lines: a map/join/fromCharCode obfuscation pattern and an integer XOR obfuscation pattern, typically executed by JavaScript-enabled processes like web browsers or scripting hosts.
Microsoft Sentinel (KQL)
