Rule Info
Name
SUSP_CMD_For_Loop_Glob_Based_Obfusc_Mar26
Author
Swachchhanda Shrawan Poudel
Description
Detects for loop variations of Windows glob-based CLI commands, potentially used in glob-based command obfuscation
Score
70
Date
2026-03-04
Minimum Yara
3.5.0
Rule Hash
79b019a585f006721f628b6fdb409a20
Tags
['OBFUS', 'SUSP', 'T1027']
Required Modules
[]
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
2
Suspicious (< 10 engines)
1
Clean (0 engines)
15
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR