KongTuke Malware - Scheduled Task Remove-NetNatStaticMapping
This rule detects the execution of a specific command-line pattern associated with the KongTuke second-stage loader. It looks for 'conhost.exe' being run with '--headless', 'powershell', '-ep bypass', 'AzureRemove-NetNatStaticMapping.ps1', and 'AppActions' all present in the command line. This combination suggests the execution of a malicious PowerShell script, likely initiated via a scheduled task, as part of the KongTuke malware's persistence or execution mechanism.
Sigma
