Rosie I
@heyrosie0 followers4 downloads31 copies0 likes265 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
1
1
Platforms
1
MITRE Techniques
1
1
1
1
1
Detects the execution of a JavaScript file via wscript.exe or cscript.exe where the file path in the command line contains a tilde (~). This is indicative of the Gootloader malware, which leverages Windows 8.3 short filenames (e.g., "ADAPTI~1.JS" for "Adaptive Algorithms.js") as part of its persistence mechanism to evade simple string-based detections. The persistence scripts are typically dropped in subfolders under the user's AppData\Roaming directory.
