KONNI AI-Generated PowerShell Backdoor Execution
This rule detects various stages of the KONNI AI-generated PowerShell backdoor execution chain. It identifies the initial LNK loader executing obfuscated PowerShell, the creation of a scheduled task for persistence (specifically looking for 'OneDrive' and 'Startup' in the task name and hourly/monthly execution), XOR decryption activities involving PowerShell and specific file paths like 'C:\ProgramData\VljE', the creation of a staging directory 'C:\ProgramData\VljE', and the extraction of CAB files into 'ProgramData'. The detection logic combines these elements, looking for the LNK loader, or a combination of scheduled task creation with XOR decryption, or staging directory creation with XOR decryption, or CAB file extraction.
Sigma
