UnregStealer - Kill Switch Check to Stager C2
Detects PowerShell IEX validating the human-operated kill switch at the lnk1.txt endpoint, which is characteristic of the UnregStealer malware's communication with its C2 server.
Microsoft Sentinel (KQL)
Detects PowerShell IEX validating the human-operated kill switch at the lnk1.txt endpoint, which is characteristic of the UnregStealer malware's communication with its C2 server.
Already have an account?