Void Dokkaebi - Cross-Platform Execution Engine (T1059.006)
Identifies cross-platform binaries (e.g., compiled Node.js or PyInstaller payloads) extracting dependencies into Temp and launching secondary network listeners.
Microsoft Sentinel (KQL)

Identifies cross-platform binaries (e.g., compiled Node.js or PyInstaller payloads) extracting dependencies into Temp and launching secondary network listeners.

Already have an account?