SUSP_PS1_Nested_InvokeExpression_May22

Rule Info

Author
Tobias Michalski, Christian Burkard
Reference
Internal Research
Minimum Yara
1.7
Name
SUSP_PS1_Nested_InvokeExpression_May22
Date
2022-06-01
Description
Detects a double nested Invoke-Expression
Tags
['T1086', 'SCRIPT', 'T1059_001', 'SUSP']
Score
70
Av Ratio
27.19
Required Modules
[]
Rule Hash
07bbdce4d54e9b03a660e4675bc5e159

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
108
Suspicious (< 10 engines)
42
Clean (0 engines)
9

Rule Matches

Hash
Positives
Total
Timestamp
VT
c78547a1641a89be4c0855896a0c108c0dfdf91a741a4140566edc8f96caec16
24
61
2022-11-28 23:52:32
b9bcbf832cdece23c5b076005436dbd18b37d90973b106d1f5d7f63000e5269f
2
58
2022-11-27 16:54:45
6bb39f0564ca9890ff63387c52f0f07e396b470b75ae69eea8db3180b2e86033
35
61
2022-11-25 13:56:16
98fa071311fdbf091d7a70d9b943478c942dd827cdbd389d62f057b7c125bb19
33
61
2022-11-25 11:23:14
8e53557653aff15cbfa320782f52e1d1ec4b0b406931ba21c3b857742b320ed5
7
61
2022-11-20 08:09:26
1c075cf54b12c283f2faa0addd8981585d950016b34bebec132d8e5ba78b97c7
30
61
2022-11-18 02:10:27
ce90d6ef6429f97d87eec3990337fcd365f43e03bfbc3d2e644c4720c82313f1
24
61
2022-11-15 10:07:00
55206d41fa191fe2f20c04b3a01028a584a348b739eb69b1fd2023361fe33700
9
58
2022-11-15 01:16:33
c135d259262fdd9163a8a123699f1061495d9eed0d67aeb01950ba048880e330
22
61
2022-11-13 20:09:24
22de28bc038aec927e627c737be7196fcfcf0b7ea26d70d10d3923f48acb0e05
2
61
2022-11-09 13:13:05
083e45f314c6cb3a813c8f93ede33327569dcbcaa2b8dc23faf56d5046febdc8
1
61
2022-11-08 04:13:41
a6f55957542982348eb412b9b49797e1931183a6bf395016885e1294c5a08dbd
35
61
2022-11-05 23:20:35
bccc37d9cb242e31e21e6eb83301f2b47345aa13644e5ce717e1652e8e0ab2f1
18
61
2022-10-31 17:28:10
6eadd5a9eb7eb44f3ff1728f2bc525dfcc0e669fe18babf476e2b85a4e06a573
5
61
2022-10-18 12:34:06
a2e86e80932b6518d45b6885db213fdfd4ca70f2b4a4c12fc3cd9ccdd8441c59
7
61
2022-10-17 15:30:08
16b2339a3c951d0d5854025ddb35372f4da1f44cb4d01048f17fb8bca982e298
17
61
2022-10-16 09:20:06
639c751dd840d446cabd502a1cb8c0f77587862bced063c762cf5b3f207049d3
16
61
2022-10-15 23:43:50
6c58d594c17f58739eae0aaa76f3f1d98f650e90f8b3591d95e0d599012dcaff
16
61
2022-10-15 05:41:49
4546c6edb62e137d862edfaf6331ce6e7dde5ca386920734c35b13b479a2a84c
30
61
2022-10-13 03:36:08
3729f57cc03cb1af621cf95ab887619adea3fcb1268ddf8252d28f65a0930437
23
61
2022-10-09 03:47:24
209146d1773e8c4608b04501a39595a19ef49b3841002963f9ba104182d93cbe
29
61
2022-10-09 02:41:07
c335e85ed38903e68db51501095e539b68477a850e87ddb3ba6d07af1cb0cc2a
0
61
2022-10-08 14:12:37
507dfd57cafc20bb9201f2ed962f2ae1b04aa3242c0a5413d210544b2ba6277f
24
61
2022-10-07 12:10:11
70ecca1a89055c5055f73561e0bf67426fd5c920fc03901b06f0cc6375f76474
22
59
2022-10-04 12:08:40
af96ec414d8ee7815530d52a1d00602fcdcca206c70854601f6b66c7731d9aa2
27
59
2022-10-04 07:25:00
7ad3a8810a02e6f81fa9019e8f7a4927d5ff6578823f94a2977930272dbf632e
22
60
2022-09-27 11:25:53
a2ff1d269a2fc407c2309a279367f107183daa7b7f03b246d863adb1d467021b
11
61
2022-09-26 22:08:46
a8217ef2d5eb51f9d0da5fa80b0b5e23b4d7a0d57fe39d86d9f877968d5dd1eb
1
60
2022-09-26 21:12:18
74fdf1574a5dd76a4fe9ca7e73346cbaa284852fab046dcaef9a4223862d6061
10
60
2022-09-22 08:09:53
c9d40bd62d38a4269ba5afd0f82243ee097a73003e540eda0784f07d3bf4efaa
20
59
2022-09-21 13:09:45
016baa630439f62035082c30c2739595bb60237a6fbec5cdc244827fe6c7061b
29
52
2022-09-21 05:17:30
1f12b8c250aa8f9d1e66caa0955fada8ccafcae1bfa66930522434771ce25525
29
59
2022-09-20 08:07:28
43ea2eea167d3941914612af0a25f570f028e2060c084c9537a61c9e3c524437
24
59
2022-09-20 00:07:41
08ab1ecabddd30d21d699f0e4cf362f207335535c1e855129d245c9134f0c7f4
31
59
2022-09-19 17:38:11
ac8cdbe302f862c4570e6571673f9ede50d1a2def1b13625f7d5c14e1401a6d0
26
59
2022-09-19 14:52:37
37686f77951d999e19fb5d3ad280bce9ade6b187f48c3090a3d84b6499159656
18
59
2022-09-16 16:29:11
a143adad460fb2bb6697132157ee9767c6d725374ef958c2824cf95d3ac4d706
27
59
2022-09-15 15:47:35
a5926ce6caa9e445495f4c796c74e345d255a76b8bc8b149b5e8656cc6de1877
28
59
2022-09-15 00:12:03
7029a6c8a61774d7de7f4c493828c02c77d1af87c4c24729f0252b282120edfd
29
59
2022-09-11 21:08:47
7f6ed2f1a64b7966f768e2c2b4c20baa10a4de0bed00c7c18163e67e13dc0282
5
59
2022-09-10 17:22:44
6a5b24f1ab687ba10c17e8ca164ac195ad41a0f524ae19d3d4a3be7d9dc7a403
8
59
2022-09-10 16:53:58
94fcbf483bbf9fc8142f648f9a7cb5723d27a1b386ca7bbcd26e89bb95dba70b
24
58
2022-09-10 12:54:42
71b175ede4fa10ac3016c0469818035115cacbb8313205e7c11cad494fd04309
17
59
2022-09-10 10:03:04
45784628e905554303e015df888fc3a7c3c62f157700e937b3f663e294e715d4
8
59
2022-09-10 07:40:34
0a53be8be486e09d0dd905575e732cda870373b7da0abfcdc112fbe34486a616
13
59
2022-09-10 05:54:53
6505014260d8ddce902eaa2186f8173e7aecb122ca8ad8cd43461a8ff68c9299
2
60
2022-09-10 05:25:44
3203dc5619c0c0ef55ec68de34bb9c07fdf853889ffef925a31a96201a56f70a
25
59
2022-09-10 03:22:23
e79332bc11f7b4b60b9ae75db8dd5e94791bb0c81cc6032c817cdb58feddfe79
30
59
2022-09-10 02:15:01
b2743f7047a7119794a28840403def40e27ff7f9575ef060c458ab4fe3e9aeb9
25
60
2022-09-06 14:00:00
a0bfa955d2bddcde702d3ea50449a8607ac45575fff7d2f10dac795b30770602
31
59
2022-09-06 12:10:58
7f4d53d5654a494438eb9cf8c4d85bed4dd688b65888473809e9fe4e18c5f58c
4
59
2022-09-04 03:35:37
793a92a11680b6a66f4245d4bea9a96f9946a2b137e692585b801576c32edf77
3
59
2022-09-02 09:44:23
c3afbf5a136b204e16eb6e1cf00cbb03ee36eff42f519f26f1d1d1e58f0b87e1
5
58
2022-09-02 08:38:09
00aa15f6668063672b21669e48a5b7c4ad0b88398e90cee7ae5f0be194f44b83
7
58
2022-08-31 20:35:00
939b255dc64f7ceb7d87df78c83ea90012d47ab32ad5fee3e3f47763210fb73e
6
58
2022-08-31 18:37:07
98fce76afac492bc6b38885671191e6a4cbfad36a1fca4f22c1cfd56436bd05b
25
59
2022-08-26 23:53:11
7e068268ee3b89d1f8800d6354c9f63cd57c00088ce0d850893b4ddd8e750573
28
60
2022-08-26 19:01:39
8458c42ddd6313618f9973424c123f8ed36ef4078cffc718531f9aef92f1b6a4
20
60
2022-08-25 23:52:05
3558840ffbc81839a5923ed2b675c1970cdd7c9e0036a91a0a728af14f80eff3
35
60
2022-08-25 13:16:10
43495413921c7e8ffbb6ddbf0f0a04f3c85a8838467f6a523078da33be1710a6
16
70
2022-08-25 04:18:21
f190c33b94560e58541b3f2740b810b393ff194ae69724f5125a98f88c0c2aff
4
58
2022-08-23 21:00:40
02a8ef5905a4fadbd82284dd73e1893044461336b02cfb5acd1dc8204cac0d29
23
59
2022-08-23 10:05:45
2ee57eedd721ab352021c1d890505e9eecebf0f24b15f03e00619046769c0391
0
69
2022-08-22 15:42:01
85c098adecf90ae9729b87821ee93094c2c81d96eae492a7a1f043e9946ed5ac
23
59
2022-08-21 23:55:56
ac054bd430cab4b8ceac3e6bdeef7640b220e7665cac590d4899c6e3b58aa5f9
30
59
2022-08-21 12:55:52
e2698875e316f75cd403c5cc0abdd2eb597e6fafe9e719ab7e612960a2886603
17
59
2022-08-21 01:07:23
45083332530b8d2779860bed41310613ff37e68239a505fe3cc957d118a33ebf
4
59
2022-08-20 21:19:38
5152a77712d36ef18fc4b35c2ff87a7f2068fc4b8b49fa33cdc9b4656edccaf2
10
59
2022-08-18 19:15:40
c6c50f7e20ab56859f6a5ee4754145c024becd16f8e79181f1aac66310704573
1
59
2022-08-18 19:08:41
770f2f928a5b6de951c8eb1387bc8427f69301c486e5208e02f06b76fa7fa97e
11
59
2022-08-18 19:03:59
d7e93645516a07f34c393d2a797d8456933315349842e4bf4b4419842a7c651a
11
59
2022-08-18 18:55:49
9cc58874a1314e639d0fc468d3a18bbe66bc5deea9443216d98baa11913d506f
1
56
2022-06-17 03:30:50
0b7a0a71f4e2571f797cff059a081089bc5a09b18e4ef7fb6661a8ec429c1950
19
56
2022-06-16 19:16:52
076b22f6815cf168a813fa64e7f0b7e45d5312de16f8c9e65593160cc2c9cb1e
5
56
2022-06-16 18:50:08
32ec74ccefc7d7feb5c8817097652fc6014c6217f5b6a2695a95e680d6958153
27
56
2022-06-16 18:15:09
50eb0ffb78908931ee490fa8bd772301efbf64cc61499d625f273bb7fd6e194f
27
55
2022-06-16 16:10:06
7e3247883be19a94f3c93bdf6f94a05bf03a00274f48908314e569204af7f11d
23
55
2022-06-16 13:52:45
d193880450e2fc96229484ae38a2e6e41c91716d2746432ea782572a1e27afdd
24
56
2022-06-16 05:18:48
fd4ee34a813f829594cc2dc760afada467c1320621e66491517e4bf95a0ace06
23
56
2022-06-15 16:54:42
d24eeb669f70dbd9a7e95a72206a5d93c117951d404864dbec7fb0d692770f34
19
56
2022-06-15 14:49:53
3b5fdfe19974d64b7018f4e3e0b68b850df3881abdd67efc068fa518b51e1773
3
56
2022-06-15 13:23:32
29a2e761b63e40523d9dc42f00235a7c884cfb035ddbbadd377cebbf0f6f9a68
23
56
2022-06-15 10:16:16
dd2b0c59ad2b28643a627c2544fc4a6cbc499aab6b340d2e76eaeb0bafe5adb0
25
58
2022-06-15 09:55:54
26a0d403343757dfe73f9c3203a2e401db3febfd37dc6c0bd7739c528dfc88bf
24
58
2022-06-15 09:54:30
e78dbcf9eb548872f3da21953f67d02a0d157dd12a0194a044a07eea47278304
23
56
2022-06-15 09:14:55
c61fe40f46226d24f0f17c46acc4db6a0091c68abc6a3d995b3f6df1bbfcbb1e
24
56
2022-06-15 04:16:57
ad32d583c227a059eed515ed617c473ca8697d6856276c390b0299b573178966
23
56
2022-06-15 04:10:55
8af0b95e1d25c545ac64f600605f2361c921739ccb719e5484beac890eff6fc1
4
56
2022-06-14 19:21:33
e7886967c692329f846ec87e8c6db4c6d7eca61a2f87563dcb398be0ce3a1d58
25
56
2022-06-13 17:17:35
3bf2bed980adca2fb8035c308241659346a37d70d53ed549d1dfd5a8e03a2c64
30
57
2022-06-13 16:22:35
a692a8db038cc63bcdc44b617387d1f41a8f4d4d3dcac55de86990c0a6c9c1c1
3
56
2022-06-13 13:44:47
d16ff4fac89e6582d3735abbca36431dd75375e47119c4cc27cd1840853f78f4
14
55
2022-06-13 08:47:52
81fb0d6e6bda4bc6e3b5470fe314de548af99e94a9b04fa9c9a6b1a84f127e0b
16
56
2022-06-12 18:17:57
c0accfd941e138a42268daaeb074b795839851c9bc33960b4606d89bbe9d12ef
13
56
2022-06-12 18:15:39
77c8f41b5a6829e341e8d887df719bb4d8d768cc0845fdacd5f3481100f8dd37
3
56
2022-06-11 20:42:56
7332f47207a603e61079af4abd8ee144fed77d663046e200e25a03499d219890
1
56
2022-06-11 19:23:35
bf0492d49d2e5c61383b2546df3eec9f2aa40272a79b741a377c9e5d620a8440
4
55
2022-06-11 15:18:37
98a81f7a4a9c0c26686ff8a86a0c506b7fca33b475c91eb60c04fc950084a67b
4
55
2022-06-11 15:11:50
8bd7e905d57f9bffe4bd6ad49f99cde323a9985c091aa21870280a683beb1ce1
6
55
2022-06-11 10:48:09
b1153487214b3fe9b2b41341ee8fcf54b2b8a478639e2d36687fa115704882c5
14
55
2022-06-11 01:53:33
ca7d181a7146226a24e7e3c2f80720b9ec9bb182dafb27053fc286cd4f27f953
23
56
2022-06-10 23:59:21
8e0f87c8efefaed76b706d6b72e07ec75566b6dcee7622e55a2e2a5339f200c8
21
55
2022-06-10 23:27:20
6b91b022e1045598467214bd95333cd40ed3bb6d70a441e85c2e773cc92a45c2
22
56
2022-06-10 18:55:17
c901bad1777ca42bea4f6d6f4673cd2bb1452ae0273c8ab10450000fe0e7cd8d
25
56
2022-06-10 14:25:22
e5c1cacc1e16872c8063e470b9028295f94ed83b559d4442a803f16c358d3cf7
23
56
2022-06-10 12:33:35
781de1ea55ce2b2cb7f20cfbb26060c254440b1a4842aabcc51044477c9d8dbc
5
56
2022-06-09 20:23:21
69357d30aba961f8fac95c8c8ea781bd27861aea63f25320562966e58389d274
2
55
2022-06-09 20:18:08
1748801dcef62d58b3824d3c164dd657e50be073a7c5e630ed3e1e595b0ef221
24
56
2022-06-08 22:21:44
ce7624899c20f14304260dc74559207f4dbd903a95d3e3966d1e345b0d45aeaa
21
56
2022-06-08 19:42:48
3aa16a340aacc5aecbdb902a5f6668f117b62e27966ab41f8a71a1dd1a08f8bd
2
56
2022-06-08 18:35:03
529f707c4023542fef2b9c5737ecf643b40cdef6e2b0fb6ab7788f7896afa7f5
24
56
2022-06-08 18:08:27
08e69b8d1b779c5981e8d284debb90ae039bea475a938de25ace539dc26f1fed
22
54
2022-06-08 14:03:32
9dfc54450552ad0cbe930716b0d2c915544378d30d6d22f463e2dad3ceee1fcc
23
56
2022-06-08 14:01:13
06f8989d905dc25340b9ef9b009f2e4029f237925ac61b35e92bab443605e480
3
55
2022-06-08 13:04:11
9ebc6bc23ecd75e320b24c9d6b7c8738ed85b4538751ebd508d6fb914ac27fb1
21
56
2022-06-08 12:03:18
cdec208ec12fa58c122db1887abb7f58c7998a9ba6eeebffc501e11de3975215
23
56
2022-06-08 12:02:09
bd737f105f39f5e824273b8423f0988c1499cabd040e65035a301ab853eaf345
19
56
2022-06-08 10:24:10
dc009a09a03b95862c3eaa5ef6bc171325bc3f8e9da806a1508ac786f54f668f
22
55
2022-06-07 23:06:25
e3ba1c45f9dd1f432138654b5f19cf89c55e07219b88aa7628334d38bb036433
20
56
2022-06-07 19:56:08
a4e3fb0c055d523e26440e56b2dc015672c4e1e44b35c4a78e87abb751494964
20
56
2022-06-07 18:13:19
3b25e5d0e26dc45096399399c661fbf92e027b40c8f333c8a106c49223aaeb2e
21
56
2022-06-07 15:08:24
ffd83cae4880651833d26ccf874402b7eb4c4c393db20932cd49f4ecf26c075d
0
55
2022-06-07 08:06:54
313593fe6d197de79cb95b4b76e04eb318d4cdfde65d714c6e51cd521be4e74e
1
55
2022-06-07 08:06:54
b5ec5b08d424c0fba5ce2786b1ded2c2cc923be7c028038cb157c0ae96bf8661
0
56
2022-06-07 08:06:54
ffbcb1ffd3b3cd1e6b0f0e579cb7645c8e09b4e4bc03e93cb0f068ab37712263
3
55
2022-06-07 07:57:14
cee035a6cb3d2e6d3680e2413beaaf8b514b952086a4637a90c113884f0bc847
20
54
2022-06-07 05:01:39
eefa6d4aa3e729adba1688cd737f78d5bdc7b62447165b5255541a962a246ddc
20
57
2022-06-07 05:00:19
ae2f202b69d15676baa77c4f1f16dda1d1f524172f99b06fe5a2dbb5f0f599e2
11
55
2022-06-07 03:30:18
42bd9efe6fa5a65e141f2f3d66aec4c588cd78292a30f3af57f1b24c6889eccf
1
55
2022-06-06 16:01:26
a600bcaa8701a3c32c42604d25d4ead9d74b9c2fa5aa34755bf5ffa0a32516dc
11
55
2022-06-06 12:20:34
1eedbbfd5b379e84f14fbd2b6e66e3f926ce293175445eb19bb661f78abd7a26
24
57
2022-06-06 11:10:30
f3f412987c463e077834fecbb9a0f19b3de393cf094b4736e2f7d9bd263d9894
0
57
2022-06-06 11:07:15
c0c9392b9334eea2cbe73485ee9c63f9e693908c3eb87f77b94a69eca394895d
14
56
2022-06-06 05:30:09
40049dbad1b57532db765877e792126779f8c2d93142d791540c5ec297747279
20
57
2022-06-06 03:54:48
2ae16b32705f145712aad85b551f1d00ebc6954840f7945ccf850091421bfce6
22
57
2022-06-06 01:15:26
e302ff011bbab714ee7bc4078bc8f8ac4fea0a8c7895feac55a04ac3f500ad1b
19
55
2022-06-05 00:39:11
c858774119e4bf466a3b001a1cb8a846ebe4b82327b2b3376d55749f2bbd9edd
11
56
2022-06-04 14:53:15
b631f6c8b38c1565b372b0af2b9c8589bf9cf91aa6f7c7f18e523a23662a788e
3
55
2022-06-04 05:14:56
2435f5bf0ecf3879794af79674320723316bc83ba910705d1ee7af2d6d818fba
13
56
2022-06-04 04:57:41
f4238d902824d716ac996c75896fbdfc560e716b860fadaa3271b1afe01445ef
3
57
2022-06-04 02:52:21
386ac13cdb3b309b528c6ce39be6b712b43f8b8922cd19e817ebbe70b67133f1
20
56
2022-06-03 23:31:33
47f96f9b888fa7bf3ccbcc29a4adb2d4bbdc14c5413dec572b14bc177fa31103
4
57
2022-06-03 22:46:45
d41220ea115cabb8f22d8f12c8bbc472494fedeaaae5789be7b6192438548143
18
56
2022-06-03 18:07:41
ce5671c292d834b04e0b27276c9b18c9f21da9d043b16ec2b3292ea5ff1b671c
22
58
2022-06-03 17:06:25
ca5857a3290ccd0a38aa27752e6f490e230f0cad7a650b0b146d99b59750ad18
0
58
2022-06-03 15:56:20
e3e4db45efab35e31cce8b6111475eac7a7d8e66842d58f905df5f94a4984fbb
0
57
2022-06-03 15:19:20
5385a798d136365b644199359dc2662de3b0d6c5adc09e4cf9cada074e8a9338
18
56
2022-06-03 12:15:40
85017c355f7544a8ec3676367cf01df2803c0a2dcac5f1b75a4db0e6b0de7e04
2
56
2022-06-03 09:48:52
8918ede0a38d40ee0b89028819dcaac6bb73d2280ad88ea2e1d0a42fd7101aa6
15
56
2022-06-03 08:02:02
4e03b26efbf9ed20c80319bc8a72d330c727a216e74c31cf97ccb5b85ab8f424
1
56
2022-06-03 07:50:30
57e73e139dff99884e9287266ca4caf826e7ec3b5e93f737198c6bf970b982f8
17
57
2022-06-03 07:34:33
6b817259bac271509241f40696a886584985b078f45923c50a056765f44d65b5
17
57
2022-06-03 07:07:02
8e986c906d0c6213f80d0224833913fa14bc4c15c047766a62f6329bfc0639bd
23
57
2022-06-02 20:51:51
983b6726492937b4ee915c9d98b9665ae86ace168eb903714a0622e5c014f7fd
12
57
2022-06-02 20:46:17
764a57c926711e448e68917e7db5caba988d3cdbc656b00cd3a6e88922c63837
25
58
2022-06-02 20:29:55
ee3a1ae5efb942500b6c81f4ddb682076d7ae2a805a47bda64297313fbb645a6
0
58
2022-06-02 20:08:12
fc2887c34e9bd5b5dc61ce389d0b28c25a57e9d2c8bc885a4b8b9527ce8dc7f7
24
58
2022-06-02 12:20:25
4f643bf57abe70e3c4ed64f05167da5d6c35f2dac1d7fda78523ab231f903575
15
56
2022-06-02 12:07:08
800a769983c44b7a6d21c746ffe1c5108b0e73d1a2a35a1691a9126eacb26bbe
0
55
2022-06-02 12:07:01

Rule Matches per Month (last 24 months)