.NET Loader - Automated Pre-Execution Tool Sweep (T1518.001)
Detects the loader interrogating the process list for a specific cluster of sandbox/analysis tools before proceeding with the infection. This rule specifically looks for PowerShell executing and its command line containing at least two of the listed sandbox/analysis tools (apateDNS, tcpvcon, any.run, joeboxserver, Dbgview).
Microsoft Sentinel (KQL)
