INC/Gentlemen Ransomware Affiliate PowerShell Cradles and Scheduled Task Persist

Suraj A@cytech

•updated yesterday•2•0•5

Detects PowerShell encoded commands, download cradles, and scheduled task creation launching PowerShell or script content, consistent with INC and The Gentlemen ransomware affiliate tooling staging.