Hunt for Nightmare Eclipse Binaries

Bhojraj Joshi@cybrbhojrajjoshi

•updated Apr 21, 2026•8•0•1,748

This rule detects the execution of suspicious filenames (FunnyApp.exe, RedSun.exe, undef.exe, z.exe, powershell.exe) from common user download or pictures directories. Adversaries often place malicious executables in these locations to evade detection and execute their payloads.