Kimsuky NUKESPED JSE Loader - certutil decode spawning PowerShell hidden

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects potential JDY botnet activity characterized by host fingerprinting and data exfiltration patterns. It looks for repeated POST requests to specific URI patterns ('/gate', '/report', '/scan') accompanied by a significant volume of outbound data, indicative of automated C2 communication or data staging. The rule aggregates metrics per host to identify high-volume exfiltration patterns and calculates a risk score based on the frequency of requests and the diversity of destination IPs.