• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    ChainShell Installer Script Detection

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Ibrahim Saud@tektrix
    •updated Jun 17, 2026•3•0•30

    Detects references to the ChainShell installer script 'VfZUSQi6oerKau.js' within process command lines. This script is associated with the MuddyWater threat group.

    Microsoft Sentinel (KQL)

    Tags

    G0069 - MuddyWaterT1059.005 - Visual BasicTA0002 - ExecutionProcess CreationCommand ExecutionWindowsWindows Defender Atpkql

    Found in

    • MuddyWater Adopts Russian CastleRAT Malware-as-a-ServiceLast updated Apr 9, 2026

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?