• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    PS1Bot Cryptocurrency Wallet Harvesting

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Ibrahim Saud@tektrix
    •updated Jun 17, 2026•0•0•2

    Detects PowerShell iterating directories for known cryptocurrency wallet extensions and associated strings, indicative of PS1Bot malware activity attempting to harvest wallet data.

    Microsoft Sentinel (KQL)

    Tags

    T1059.001 - PowerShellT1083 - File and Directory DiscoveryTA0002 - ExecutionTA0007 - DiscoveryCommand ExecutionScript ExecutionPowershell Script ExecutionFile AccessData ExfiltrationWindowsWindows Defender Atpkql

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?