Product
Community
Enterprise
Plans
Intel Exchange
Intel Exchange
Detections
Resources
About
Leaderboard
Join Community
Sign In
All Detections
CrystalX RAT cmd.exe spawned from CrystalX temp payload
Glass
DiceBear
https://www.dicebear.com
https://creativecommons.org/publicdomain/zero/1.0/
„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
Ibrahim Saud
@tektrix
•
updated Jun 22, 2026
•
3
•
0
•
9
Detects cmd.exe spawned from CrystalX-style temp executable lineage.
Sigma
Translate
Download
Copy
Sign up to view this detection
Next
or
Create account with Google
Create account with Microsoft
Already have an account?
Log in
