Kimsuky NUKESPED ADODB.Stream Payload Staged in ProgramData with Obfuscated Extension

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the creation of executable files with suspicious naming patterns within the C:\ProgramData directory. The rule filters for files with specific file extensions or high-entropy name patterns that do not match common Windows executable file types, potentially indicating staging of malicious payloads.