Dragon Weave - Internal Component Extraction from ZIP

Ibrahim Saud@tektrix

•updated Jun 19, 2026•1•1•5

Detects the extraction process where specific files (empty.vbs, Profile.ps1, 1.dat, Com.dat) associated with the Dragon Weave campaign are simultaneously unzipped into a 'data' folder. This rule looks for the creation of at least three of these four files within a one-minute window by the same initiating process.