Signature Base unknown stable yara

MAL_CRIME_Unknown_ISO_Jun21_1 [yara]

Triggers on ISO files that mimick NOBELIUM TTPs, but uses LNK files that call powershell instead.

View Source

Detection Logic

filesize < 5MB and all of them

Field Validations

Loading…

Comments (0)

Loading comments...