DeadVax / AsyncRAT Detection Rules
This rule set detects various artifacts associated with the DeadVax campaign, which deploys AsyncRAT. It includes rules for known file hashes, VHD lure files, WSF scripts, components of the script chain (rEgX.cmd, mbs.exe, boot64x.w, IntelDriver), phishing MSG files, AsyncRAT shellcode markers, persistence mechanisms (scheduled task name), loader components, network indicators (C2 and IPFS delivery URLs), and common process injection targets (RuntimeBroker, OneDrive, taskhostw, sihost) combined with API calls indicative of injection.
YARA
