Blake Miller
@NotNull0 followers0 downloads2 copies1 like17 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
1
Platforms
1
Products / Services
1
1
MITRE Techniques
1
1
1
Detects the use of Node.js or Python with inline execution flags (-e or -c) and a long command line, a technique used by DEV#POPPER stagers to run obfuscated code. The rule specifically looks for keywords like 'base64', 'urlopen', 'exec', and 'import' in the command line, which are indicative of malicious script execution.
