Rule Info
Name
SUSP_JS_Info_Gathering_Sep26
Author
Marius Benthin
Description
Detects JavaScript files collecting host information such as OS platform, architecture, release, uptime, CPUs, home directory and Node.js version, which is typical for system reconnaissance by RATs
Score
60
Date
2026-09-28
Modified
2026-10-01
Minimum Yara
3.5.0
Rule Hash
06b920ef24960734ed2c07a1505456aa
Tags
['T1059_007', 'SUSP']
Required Modules
[]
Virustotal Matches
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
7
Suspicious (< 10 engines)
6
Clean (0 engines)
24
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR