CryptoBandits JScript Clipper Polling clip.exe for Crypto Wallet Address Replacement
Detects suspicious activity indicative of CryptoBandits malware, specifically JScript stealer polling the clipboard and beaconing actions. This rule identifies instances where wscript.exe or cscript.exe spawn clip.exe (for clipboard access), curl.exe (for C2 communication via Tor SOCKS5 with specific keywords like 'REPL', 'SEED', 'PKEY'), or cmd.exe within a staging directory like 'Public\Documents'. It also looks for specific filenames in the command line such as 'exefu.js', 'ofolu.js', 'words.txt', or 'ugate.exe'.
Microsoft Sentinel (KQL)
