All Detections

Uat11587 Zdi Can 25373 Lnk Canonstager

avatar
Ankit Mehta@Secvyn
updated 6 days ago000

Detects UAT-11587 diplomatic-lure LNK file exploiting ZDI-CAN-25373 whitespace padding to conceal a PowerShell command that extracts CanonStager (cnmpaui.exe/dll) from TAR archives into %TEMP%

YARA