Passiveneuron Base64 Decoded and Dropped Payload Deployment
Detects the use of PowerShell to decode a Base64 encoded string and write it to the filesystem. This technique is used by adversaries, including in the PassiveNeuron campaign, to drop web shells or other malicious payloads.
YARA-L
