Feral Wolf nyx.ps1 download-and-execute via IEX

Ankit Mehta@Secvyn

•updated 21 days ago•0•0•1

This rule detects the execution of suspicious command lines involving 'evilsocket/nyx' and the use of 'iex' (Invoke-Expression) within PowerShell or common download utilities (curl, wget). It also correlates this with network connections to 'raw.githubusercontent.com' fetching 'nyx.ps1', which is a common pattern for downloading and executing malicious scripts in memory.