Apt36 Malicious Encoded Payload Execution

Tim Peck@timpeck

•updated Aug 25, 2025•2•1•40

Detects the execution of a malicious Linux payload, possibly within a .desktop file, a technique used by APT36. The rule identifies a bash process executing an inline command that downloads and runs a payload, often using a combination of curl, xxd, base64, and eval.