Luke Kuenning
@MtnMarathoner0 followers11 downloads0 copies0 likes65 views
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Categories
2
1
1
1
1
Platforms
2
MITRE Techniques
2
1
1
1
1
Detects PowerShell attempting to read a specific batch file named 'rEgX.cmd' using Get-Content, a signature behavior of the Dead#Vax self-parsing loader. This technique is used to extract a hidden payload from the script itself.
Detects the creation of a scheduled task designed to execute a VBScript from a temporary or user-specific directory. This technique is used by the Dead#Vax malware to establish persistence with a layer of indirection, avoiding direct PowerShell execution from the task itself.