Chaos Ransomware Group PowerShell Activity

ravi vaghasiya@ravivaghasiya

•updated Aug 1, 2025•4•1•46

This rule detects suspicious PowerShell command patterns associated with the Chaos ransomware group. These commands are used for environment setup, preparing for large file downloads, and remote command execution.