Handala Detection

Bhojraj Joshi@cybrbhojrajjoshi

•updated Apr 21, 2026•6•0•340

This rule detects the execution of specific suspicious scripts, 'dra.ps1' or 'handala.bat', via common Windows command shells such as PowerShell (powershell.exe, pwsh.exe) or Command Prompt (cmd.exe). This activity could indicate malicious execution of known adversary scripts.