PowerShell reflective load of AES/Gzip-decrypted .NET DLL (StealC)
This rule detects PowerShell script execution patterns indicative of the StealC 'ClickFix' infection chain. It specifically looks for the reflective loading of an obfuscated .NET assembly from memory, involving common .NET cryptographic and compression classes such as AesCryptoServiceProvider, GzipStream, and assembly loading methods like Assembly.Load. The rule uses markers and script length heuristics to identify payloads characteristic of this malware delivery technique.
Splunk (SPL)
