Rule Info
Name
MAL_VAE_Sideloading_Payload_Oct26
Author
Jonathan Peters (cod3nym)
Description
Detects sideloading payload that serves as the initial stage for a malware delivery as a service operation.
Score
80
Reference
Internal Research
Date
2026-10-14
Minimum Yara
3.5.0
Rule Hash
2d0d8edd179b40ca82245e0e18b4f0ae
Tags
['T1574_002', 'FILE', 'EXE', 'T1569_002', 'MAL']
Required Modules
[]
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
1
Suspicious (< 10 engines)
12
Clean (0 engines)
0
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR