All Detections

Command Line Execution with Suspicious URL and AppData Strings

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 202504

Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)

Sigma