Screening Serpens - Fake Hiring Portal Extract and Run

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•3

Correlates the extraction of the Hiring Portal zip file with the immediate execution of its payload. This rule detects the creation of files within a 'Hiring Portal' folder followed by the execution of 'setup.exe' from within a 'Hiring Portal' path within a 5-minute window on the same device. This behavior is indicative of the 'Screening Serpens' campaign.