SUSP_PS1_Indicators_Dec21_2

Rule Info

Description
Detects unknown malicious PowerShell script
Reference
Internal Research
Tags
['SCRIPT', 'SUSP', 'T1059_001', 'T1086']
Date
2021-12-21
Required Modules
[]
Rule Hash
9ded882b745952c4ddf9e5c879dbe4d2
Score
65
Av Ratio
8.4
Name
SUSP_PS1_Indicators_Dec21_2
Author
Florian Roth
Minimum Yara
1.7

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
20
Suspicious (< 10 engines)
62
Clean (0 engines)
43

Rule Matches

Total
Timestamp
Hash
Positives
VT
58
2022-05-26 13:06:29
d53854871033fbb08f3a9b049418f122057c395c0aee6e86b2915db20e1efd29
9
58
2022-05-25 19:05:41
e339c6468cdefc05130f89b4b307fe14216d4c49fb6186aa8674b61405f6071d
7
54
2022-05-25 16:26:04
614c593c692a0acf0acccd0c39b189e243221ebfb8f884f0a0cf6ad45f7990a8
0
65
2022-05-25 07:31:54
594c2b31ff945c748fa9448e837edc29aa9da70fc73dace6237a23178571c4b1
42
67
2022-05-25 06:11:45
fb7e9fa332ca5014a9fa3a2fcc2b6be75454fc191e814936d35a8e111d15bf9e
41
57
2022-05-23 11:36:53
80268413e4bb91b92841d9851eff31586835073be65e6c4c52d277cc53ce7275
0
57
2022-05-21 05:06:47
4545dd9ca5edc2474ac45c6f494ed190f99f513028b5d1efad6f8c345345b6df
5
58
2022-05-16 13:07:56
b0f3800e6a4b802c68763b42f30a414e5f2848b371b9015122838f62bc7a94dd
4
57
2022-05-12 23:45:12
e16618ba096a8f5b2d9f28c35c2f72a954f09c87394cfd7a2460cb7cdf7f8585
0
58
2022-05-12 23:09:03
1f3d1723f2ee5743a1d19a2ff1f3b3820907eff6671c4996e1b15d38850a0c71
0
58
2022-05-12 21:10:27
5491629715ef7910c8c6774605f833b094f27212391d992d6af67e5e810e58b2
0
59
2022-05-11 14:21:02
bb44196ee85cfb86a7552b6a14e47eef37ba136bf2c6b8bd71787d8edd5f9267
5
58
2022-05-10 14:51:49
8a294d440716615495e8b521569968f31d5583cd716d487f8d875c091186f87d
0
58
2022-05-10 13:19:09
6eb3b75748a4a3e36aec52e7ff4fe994c7657d5eb919902705009656de29a755
5
58
2022-05-09 01:15:22
f09d7e95efdda5f521c4eae55c000fe8402cb7ff211e3919368ed7951f1c82f1
0
58
2022-05-05 15:56:39
32648296634fea6b84f4ca3be795a4fedead8772be1a8ba285ec235e655e0738
1
58
2022-05-05 15:50:00
7d73ed8d6f0b418443cc20153127d6486b92b1784157c723d936037f1e111bca
1
57
2022-05-05 15:45:24
710ff315d4c8f02411bdf348ee194da2d6e14f4cf27d451378bd7726ffa7f7b8
1
58
2022-05-05 15:37:14
ef3b911ece7a318a209117026d0e465d19a1e18278853d545e0e18c4aa0c4789
1
57
2022-05-04 19:57:26
7b2b194e3ee9c25138d3768c7fdc97a67794a8f87677677deaa64d17a55bb815
1
57
2022-04-29 21:07:07
d8b8a90ac183ae6e160fa7c248fae1e313d10efa151f0653dec1fe2f3a794220
5
58
2022-04-28 11:28:46
b8d5bd330f32c934a839b008ef1a0bdf1da4c4e2f6c1dc75f0fef28a1f46015a
7
58
2022-04-28 11:27:40
e037e586ae64952ef04e62432e79911dbabb93d73a22912668d148ad3245643c
8
58
2022-04-28 10:22:01
44bef17aba7e401344197d16b0940c137da245639c4f98a54ee2637a84a84804
4
58
2022-04-26 09:20:10
0f8f489f1b9713b202d0cc137d6bfafb3c8585bf0c4674748d52faafcb136db8
0
57
2022-04-26 09:14:38
ac9a6c0aabfc246417fd71d9c2282e39411c660cf2853e09ffac1d303214ad3c
11
58
2022-04-21 10:38:17
ae72dd33b2ff8ea2c8dbd781da1bc3b8544d7b5a1b39d407f388e06b872e9ae3
9
58
2022-04-19 09:16:56
82597e00f4a0b5a2589976c57f2ba89824ffac69af15733db9bef491e5c38828
0
57
2022-04-18 11:59:05
5bec6e2d8571d41ca9928a496178a5d6be27615648160552f23d40b8cef1e0c3
6
57
2022-04-15 04:08:12
93cf4edda9c05816541c62f4d1de6d6651293c4ec2de00b6c48947cb7ad1d629
1
58
2022-04-12 15:04:15
00dcb4fe73bd3620d86bf41b7a0b09e2614a6d81bc49c037758f96315a296d6b
0
56
2022-04-12 12:10:02
68aca1f77a38b9eb93bf4a26eb0c6e6bc930fbf9b1a7a41d8716abdcd6d75870
0
58
2022-04-12 07:25:37
e6a87758bb2865c02c8a41d0f47ed69b11cb7b8343aad11fee29a75fb34f6e96
6
58
2022-04-11 15:06:12
0bef52cf52ffbe76b068aca3433b7d43f548678bc31e2fd1a62aa03fdd2dec5d
8
58
2022-04-11 13:07:37
0cab7e961ebfd102beeffca34415edc6cbc62362c0dd576c00ddc7804bac752c
0
57
2022-04-09 23:06:11
cc770a5f05477758088afe52184f0b4b9638614f24ecdfa5339b4224709a8609
7
57
2022-04-09 08:29:40
66eefc10c1e830237b2e77bb6611462d6ba0fba9c77583b98879f7e8ad344765
0
57
2022-04-08 12:58:35
f7a9a42f77f96000efc522fc9d3917019a799658b23d49a0af48936d6b088fef
6
57
2022-04-07 16:18:10
09c7c5a7e4d364b91e3c107109156fdf854733f6bed654490e97b0421a8a6f03
0
57
2022-04-06 20:37:20
45ab13eab38b7345d983406a58482c2d8470f48c07a1665569f845a398872b28
0
56
2022-04-06 17:46:00
7784bb0326950ddff136bc17389ed3682ca82f0c675a54a72cad06f051822809
0
56
2022-04-06 10:14:24
eecbf7c3e3950b8df62e55da6b672bea8f97704eb81ea549309ba8ed4534af25
10
55
2022-04-06 10:13:59
0ff2e5fe1e7ff683f36654ac81c0b38be69599bdaf02b3023049515de1d14293
0
57
2022-04-05 20:12:20
724095060c3b91cb7a0f6041f09727e31c051cb7238cdfba98673ad38e6da5b5
0
57
2022-04-04 23:57:44
35c88577895cf0dfc66cb1106642b66899a9ea07d989591d1d49e91dfd7a415e
0
56
2022-04-03 16:07:45
57ecea99b48170b905a561b75c1e08007e49da4da97775b59b1c5650abbf108f
0
56
2022-04-02 09:05:05
abfe111841d08097944cc81468881318fc001da912f421feaa4238f9eeb6abc5
0
57
2022-03-29 12:43:32
733d92c0a7f3c8c44c4fcd8940cd25a0c2b42920b35d827813dd99a11aba14a8
0
57
2022-03-29 02:35:19
0db44b98a3378f480851f4273c00988c21423b2242f084bff017e4c92d0315b3
1
55
2022-03-28 21:01:16
39619b2616cc984ed3e37d9345dfad2a904976765f23e7349b4b37242cd847a7
0
57
2022-03-27 14:34:29
638c2e6e6aacaf0c1501ce44fe10d7eb2c329aa4eb76210db596beea5318fbd3
0
56
2022-03-24 20:46:49
f1993ae201097c03c38ff0470a043b5c3f2552fd1efb5489a458139e74d19240
0
56
2022-03-23 05:57:13
1618273d538fac9f11ef8678a1f5c06ac35139681715e7831b6b3d4b46559d2d
6
56
2022-03-21 05:01:14
d881c193d570ba02337cf5c65963f4c061ae30304d323ab31e9157b7516265f4
8
56
2022-03-20 19:09:52
6938568708321b37e4a30ae35a0ac8d7f79c97ebd008c5eebb85bf9099305402
0
56
2022-03-20 18:58:37
6a9fe701b09896e41412fd603f4dd5ff9ae8991e3df8fcce27f77c3c0f51cf53
0
55
2022-03-18 00:28:43
1726ddb5ca24579c5ca654827b1cfc78ea9223c46b3f7c509dd4046834b96b0d
0
55
2022-03-17 03:24:37
afff0e1166c3691e2d094fece993b3431d0f47b59d50c097804dfc979f47cbb0
0
56
2022-03-16 12:47:49
483798c0218d07c1e2900f221949a64392e37e088e83d740a4bf63d9c64b058d
10
54
2022-03-16 04:06:01
abf5164f2c41cc1a6e17353ac750fc7e3b7d36409017ee1017996defba0e1d08
0
55
2022-03-11 16:11:42
6d174a6372e2ddf71b8a09b350eb8039127e3fc8dab83d3972286ff933db6060
8
55
2022-03-11 11:48:02
562c5ef4cbda3467f7dfbe6ca1f57af558c08d8fa76d4952348aa3a0e58f87bc
5
55
2022-03-09 08:44:08
aab251fe07176ff5ada517464a615713af7ad0fb9fc906865d8583095b2ce240
8
68
2022-03-08 12:03:18
66ac8e1ad19b16b93cdd1afb8106dd633dccb33b6bef0756f03925821f9736fb
17
56
2022-03-07 17:52:59
c9104701d0a48a4c02d2f76336b10d7b8ee002d4b2829078e9290b0b15fa421a
6
55
2022-03-06 05:16:26
27f23b57afb8c28ca7bbe0b089404a75c9ae95701bbfa248d06c4d2e6ba18261
0
56
2022-03-05 16:32:09
e8d6708d5cdeab0101f987bf4e3ed30f95ecbe360ff54c118f7e425a12c77f4d
6
56
2022-03-05 16:15:11
dca46d6dfde3badd973643b1f66083723fdcbf5e5572c6ca1cf4d8cdf8b65ec8
6
56
2022-03-05 16:12:56
8ddc50baabfc5be0b4258797a04c0cf068c83edab785cccb2c9b3fa6e18294a5
4
55
2022-03-05 07:54:00
96ded19bcf92be3c3b32f946b955d7d5fc864b45b386390f65b46cd9f409e914
9
56
2022-03-05 07:49:37
a106fa4be913a3a50a022203f0ef8be6cace33ebaa0a30eed2597c7ce4884a80
0
54
2022-03-05 07:43:59
ede0b9a24858d3b150b52f859b0b84c82b523ad5c9f5bb068828c630a0bc2d28
10
56
2022-03-05 07:38:11
cc293b4bfa0ed84213d4dd35836c440e99e5796727458ae581f203833bbf13a7
6
58
2022-03-01 18:39:08
794f1962254cb98786b14fe0907bd2089329ca2faf1a4b672fe21a980c08e4b5
1
58
2022-03-01 07:24:44
cefb50d9c365c370a98040579206a20901d57c6428741e1bdf7cc9c10f7d4df5
0
58
2022-02-28 16:08:49
64ab6185c318c4c61ee083027823ff26892f3eaf5c34c9244a2a4d1cc9737585
10
57
2022-02-28 13:39:04
be2d4a06ce089a7e1a95ab741d407129ea415412dc8164ad622a9c367645f2c1
5
58
2022-02-28 01:24:04
408e95a57349153c61938ae27aad5902be4fa3012118fe39d4c20fef8372a885
0
57
2022-02-24 14:41:31
4052123bf4fedbfa6fbfff0928d9b671ad5e312d380e8907cde204a96ce1a5e8
3
57
2022-02-24 13:50:34
f2d5bff34317228e9ab401eeafb2f0b5dc66dc298ca429fbf8a8d3bc6d10ee4e
4
55
2022-02-23 15:11:22
632f678020fef14889915f6193a1734d4c3d7cc897f8fc5e6aaea401cb91739a
0
58
2022-02-21 11:17:38
e29fc4f09918e6243bdf4545ace8aa140d08904e7abc78fb155092c52e76defb
7
57
2022-02-18 08:08:12
d5ad6f302461ac6d2aa4de5bd76f94aa1d274f38638adff3e264312d78b7ffdc
1
58
2022-02-17 13:24:12
901396640fe3a16469326cb70026b21af87cca722698a22d10b1a41c0feffce2
5
57
2022-02-15 19:16:38
1974f9b3c01e43add00d8fc0a818b04e6223cbc5801b1c8c49545780f3bdfcd3
14
58
2022-02-13 11:39:44
9ac8ca31b10c74fd04b339c5b800ecb37a04c1fba3099b00db4b23b88690dbca
5
57
2022-02-13 10:59:31
8d9f3238d1ebc5d2d43ecbb5d56f757bf13ab73231cbcd13e3b276de37e7da52
5
58
2022-02-11 05:24:45
49201d7b6065f3fb62e50b537599ff550d798463d673b34faa1597b96b73fccc
13
58
2022-02-10 22:00:40
a8902d91e27147f0bc12f878516b404c6c3fa320f05dae6cbf1958cccb8fe4ac
1
58
2022-02-10 21:52:04
5c89f33b9b084101ebfbd133a509a346010d6b39bb9341057e9cfca3c946af58
0
55
2022-02-04 20:40:22
7a1ca1dff19b2ac961110532c25858a15dc0fcc469dcf35c73ca69da6e659707
1
55
2022-02-04 20:19:07
d0d02eafa1b97762517285480efc91f47c2b6812a6f3b90410fa5a99beac587d
10
55
2022-02-04 20:10:01
3b33635f047bf8d331672019e1c26cf0cc1450fe5ff3ba4559940b79aac26e8b
13
58
2022-01-31 14:19:22
8a0e9d3c46d5c5f1c0f92f763116e31aaace750acbfc578dc5904ddc5094d811
1
57
2022-01-31 14:07:46
4cb4de94b2762a084126b3d872c5bc194d3ce0924b42787eb761bcd636728a8c
10
58
2022-01-31 10:36:03
d270b1438e68a8da2a04edf147ac59207a9fc32219dc74775015f0562a2d09e6
8
58
2022-01-31 10:21:18
e95262cfdf79a589b9234f2e1819237b1cb1f90d2ede1e3341faab3e2aaa1329
6
58
2022-01-31 10:16:09
e909210a463517f4186bd4f4b18d61cd0f15b8eddf5bca28eb784835aaafee37
9
57
2022-01-27 22:38:48
d967158a0b7c397ad995c4de18e5819507910657594f173eb65f90396bf4a952
6
57
2022-01-25 21:18:49
784b707d3623e79e447d098bbc566198524e6fde70bf6641a2569d61391e19f6
0
56
2022-01-24 20:06:10
3a9e7fa193d773bfb56dac6982dba021a32bb7265d571d5fa9bf1c92cbb8719f
4
56
2022-01-22 18:47:16
eaecf68d6b44240c1b3f468875db58c741daf8123795a8a81b181b7ea3c34017
6
56
2022-01-21 09:02:15
50e5321913806f0ad97ea063228ade54f4ce54ec72eae3c0659c9a6f056f5cc0
0
57
2022-01-19 04:23:51
f2cab955d7019484c7e78f5fd3a95405c1deae0ab6c60fb0f39541b448d06ec4
11
56
2022-01-19 03:04:31
afb049422c63283d0ed69c111674920ef5771d0531d77476cde127777768ae38
9
56
2022-01-18 19:11:47
98a0fd48504a0988223ec7de3418d0a7d8b8aecd490960502b7a58f44a344564
0
57
2022-01-18 00:02:12
5ba0d49cf27e35d0e728f1b91279ef3c9f91c83369c67333766fb008f467ec15
1
55
2022-01-16 17:39:01
dfa7550bd486852581ffdf73757cf03a6d8b47be5d7b3ee74fe6854deaae2b00
0
57
2022-01-15 15:25:31
1ab9629165ef96f7985d1a64934d9bc9e0d355914fe55b08150c1d420851ad12
10
56
2022-01-09 08:33:42
21990d14df2b312154f7e6c10eed6122657426129bffae88d787e889624eaf0c
0
55
2022-01-09 00:21:52
b002546dbbd02acafd426ef78b91cca7337e02b6082320a7e3c5f8a9eeb6c4e9
0
57
2022-01-07 04:27:30
90d015430e99f9a5a9e8a893b121d74dedb44153afa775e0d65c4d22388f01c7
5
56
2022-01-05 22:10:54
0e4d4abf52451a85cb8256edcbd6b1e95b4c8e8e5e503a0939f516cd36af8687
5
55
2022-01-02 16:06:31
4b3ab6094195568752fe8635cadf472a6531bb03aefcaced9087b182a7286deb
13
56
2022-01-02 14:11:05
0018c7dad2cc306f1be015fc32bbaa6077b5632e34c3f140ff4466d2db0559b8
10
56
2022-01-02 13:18:12
c35ee5399f4f4e294fd43c877897539df273f2ecc523ea0288d93ecdc4c8adbe
0
56
2022-01-02 13:15:00
a10c1872813064285de8d0ed1bdb68c4b0302d0c2e08280022d606c60976be75
11
57
2022-01-02 08:18:19
ee83173df90bbfa909af5f9a0d90511ebc1e304e7b2b1aa271d4af0b30f811b3
5
58
2022-01-02 07:56:57
02019ec485475a032fcfbde0e5d1b95458ff263b3d38cabcd0ddc659d24428d3
6
55
2021-12-31 21:10:57
10f67d7b8c206906742f900c50c47989467f33c5b6808e632aeed498033aa84a
3
68
2021-12-31 21:09:28
6dab7abf678a97146d9fec52ba794686cca641957289357018b9c07b74af0b2a
31
57
2021-12-30 18:29:34
3dd030d0553e153ec1effde166adcce6b04600f615a115858c0cad58a5b6452e
10
57
2021-12-29 10:11:49
4018b0486c69a9c15deb99b84d1fc6c3304051a6983568a4b8035379310d9567
4
57
2021-12-25 13:57:59
44699d7e2b9542704e7abd845401776ca1b3f37d0ca7d149b72bb91bdac1a08b
6
56
2021-12-22 17:43:44
db16d4c57e18bedade5f1f1ae9a30ce94f18ddc9a4b3d1f5de826bb80ccf0b2a
6

Rule Matches per Month (last 24 months)