Ariel Ropek
@arielkr0 followers25 downloads8 copies3 likes212 views
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Categories
2
2
1
1
Platforms
2
Products / Services
1
MITRE Techniques
2
1
1
1
1
This rule detects PowerShell processes (powershell.exe, pwsh.exe, mbs.exe) that are executing commands to read the content of batch (.bat) or command (.cmd) files. This behavior has been observed in campaigns like Dead#Vax for self-parsing and in-memory payload extraction. The detection specifically looks for `Get-Content` or its alias `gc` within the PowerShell command line, targeting files with `.cmd` or `.bat` extensions.
Detects the execution of a Windows Script File (.wsf) from a suspicious or non-standard directory, such as temporary folders or removable/mounted drives. This technique was observed in the Dead#Vax campaign where a WSF file was executed from a mounted VHD to initiate the infection chain.