SUSP_PS1_Nested_InvokeExpression_May22

Rule Info

Av Ratio
25.62
Score
70
Name
SUSP_PS1_Nested_InvokeExpression_May22
Minimum Yara
1.7
Required Modules
[]
Description
Detects a double nested Invoke-Expression
Reference
Internal Research
Date
2022-06-01
Tags
['SCRIPT', 'SUSP', 'T1059_001', 'T1086']
Rule Hash
07bbdce4d54e9b03a660e4675bc5e159
Author
Tobias Michalski, Christian Burkard

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
59
Suspicious (< 10 engines)
22
Clean (0 engines)
7

Rule Matches

Positives
Hash
Total
Timestamp
VT
1
9cc58874a1314e639d0fc468d3a18bbe66bc5deea9443216d98baa11913d506f
56
2022-06-17 03:30:50
19
0b7a0a71f4e2571f797cff059a081089bc5a09b18e4ef7fb6661a8ec429c1950
56
2022-06-16 19:16:52
5
076b22f6815cf168a813fa64e7f0b7e45d5312de16f8c9e65593160cc2c9cb1e
56
2022-06-16 18:50:08
27
32ec74ccefc7d7feb5c8817097652fc6014c6217f5b6a2695a95e680d6958153
56
2022-06-16 18:15:09
27
50eb0ffb78908931ee490fa8bd772301efbf64cc61499d625f273bb7fd6e194f
55
2022-06-16 16:10:06
23
7e3247883be19a94f3c93bdf6f94a05bf03a00274f48908314e569204af7f11d
55
2022-06-16 13:52:45
24
d193880450e2fc96229484ae38a2e6e41c91716d2746432ea782572a1e27afdd
56
2022-06-16 05:18:48
23
fd4ee34a813f829594cc2dc760afada467c1320621e66491517e4bf95a0ace06
56
2022-06-15 16:54:42
19
d24eeb669f70dbd9a7e95a72206a5d93c117951d404864dbec7fb0d692770f34
56
2022-06-15 14:49:53
3
3b5fdfe19974d64b7018f4e3e0b68b850df3881abdd67efc068fa518b51e1773
56
2022-06-15 13:23:32
23
29a2e761b63e40523d9dc42f00235a7c884cfb035ddbbadd377cebbf0f6f9a68
56
2022-06-15 10:16:16
25
dd2b0c59ad2b28643a627c2544fc4a6cbc499aab6b340d2e76eaeb0bafe5adb0
58
2022-06-15 09:55:54
24
26a0d403343757dfe73f9c3203a2e401db3febfd37dc6c0bd7739c528dfc88bf
58
2022-06-15 09:54:30
23
e78dbcf9eb548872f3da21953f67d02a0d157dd12a0194a044a07eea47278304
56
2022-06-15 09:14:55
24
c61fe40f46226d24f0f17c46acc4db6a0091c68abc6a3d995b3f6df1bbfcbb1e
56
2022-06-15 04:16:57
23
ad32d583c227a059eed515ed617c473ca8697d6856276c390b0299b573178966
56
2022-06-15 04:10:55
4
8af0b95e1d25c545ac64f600605f2361c921739ccb719e5484beac890eff6fc1
56
2022-06-14 19:21:33
25
e7886967c692329f846ec87e8c6db4c6d7eca61a2f87563dcb398be0ce3a1d58
56
2022-06-13 17:17:35
30
3bf2bed980adca2fb8035c308241659346a37d70d53ed549d1dfd5a8e03a2c64
57
2022-06-13 16:22:35
3
a692a8db038cc63bcdc44b617387d1f41a8f4d4d3dcac55de86990c0a6c9c1c1
56
2022-06-13 13:44:47
14
d16ff4fac89e6582d3735abbca36431dd75375e47119c4cc27cd1840853f78f4
55
2022-06-13 08:47:52
16
81fb0d6e6bda4bc6e3b5470fe314de548af99e94a9b04fa9c9a6b1a84f127e0b
56
2022-06-12 18:17:57
13
c0accfd941e138a42268daaeb074b795839851c9bc33960b4606d89bbe9d12ef
56
2022-06-12 18:15:39
3
77c8f41b5a6829e341e8d887df719bb4d8d768cc0845fdacd5f3481100f8dd37
56
2022-06-11 20:42:56
1
7332f47207a603e61079af4abd8ee144fed77d663046e200e25a03499d219890
56
2022-06-11 19:23:35
4
bf0492d49d2e5c61383b2546df3eec9f2aa40272a79b741a377c9e5d620a8440
55
2022-06-11 15:18:37
4
98a81f7a4a9c0c26686ff8a86a0c506b7fca33b475c91eb60c04fc950084a67b
55
2022-06-11 15:11:50
6
8bd7e905d57f9bffe4bd6ad49f99cde323a9985c091aa21870280a683beb1ce1
55
2022-06-11 10:48:09
14
b1153487214b3fe9b2b41341ee8fcf54b2b8a478639e2d36687fa115704882c5
55
2022-06-11 01:53:33
23
ca7d181a7146226a24e7e3c2f80720b9ec9bb182dafb27053fc286cd4f27f953
56
2022-06-10 23:59:21
21
8e0f87c8efefaed76b706d6b72e07ec75566b6dcee7622e55a2e2a5339f200c8
55
2022-06-10 23:27:20
22
6b91b022e1045598467214bd95333cd40ed3bb6d70a441e85c2e773cc92a45c2
56
2022-06-10 18:55:17
25
c901bad1777ca42bea4f6d6f4673cd2bb1452ae0273c8ab10450000fe0e7cd8d
56
2022-06-10 14:25:22
23
e5c1cacc1e16872c8063e470b9028295f94ed83b559d4442a803f16c358d3cf7
56
2022-06-10 12:33:35
5
781de1ea55ce2b2cb7f20cfbb26060c254440b1a4842aabcc51044477c9d8dbc
56
2022-06-09 20:23:21
2
69357d30aba961f8fac95c8c8ea781bd27861aea63f25320562966e58389d274
55
2022-06-09 20:18:08
24
1748801dcef62d58b3824d3c164dd657e50be073a7c5e630ed3e1e595b0ef221
56
2022-06-08 22:21:44
21
ce7624899c20f14304260dc74559207f4dbd903a95d3e3966d1e345b0d45aeaa
56
2022-06-08 19:42:48
2
3aa16a340aacc5aecbdb902a5f6668f117b62e27966ab41f8a71a1dd1a08f8bd
56
2022-06-08 18:35:03
24
529f707c4023542fef2b9c5737ecf643b40cdef6e2b0fb6ab7788f7896afa7f5
56
2022-06-08 18:08:27
22
08e69b8d1b779c5981e8d284debb90ae039bea475a938de25ace539dc26f1fed
54
2022-06-08 14:03:32
23
9dfc54450552ad0cbe930716b0d2c915544378d30d6d22f463e2dad3ceee1fcc
56
2022-06-08 14:01:13
3
06f8989d905dc25340b9ef9b009f2e4029f237925ac61b35e92bab443605e480
55
2022-06-08 13:04:11
21
9ebc6bc23ecd75e320b24c9d6b7c8738ed85b4538751ebd508d6fb914ac27fb1
56
2022-06-08 12:03:18
23
cdec208ec12fa58c122db1887abb7f58c7998a9ba6eeebffc501e11de3975215
56
2022-06-08 12:02:09
19
bd737f105f39f5e824273b8423f0988c1499cabd040e65035a301ab853eaf345
56
2022-06-08 10:24:10
22
dc009a09a03b95862c3eaa5ef6bc171325bc3f8e9da806a1508ac786f54f668f
55
2022-06-07 23:06:25
20
e3ba1c45f9dd1f432138654b5f19cf89c55e07219b88aa7628334d38bb036433
56
2022-06-07 19:56:08
20
a4e3fb0c055d523e26440e56b2dc015672c4e1e44b35c4a78e87abb751494964
56
2022-06-07 18:13:19
21
3b25e5d0e26dc45096399399c661fbf92e027b40c8f333c8a106c49223aaeb2e
56
2022-06-07 15:08:24
0
b5ec5b08d424c0fba5ce2786b1ded2c2cc923be7c028038cb157c0ae96bf8661
56
2022-06-07 08:06:54
1
313593fe6d197de79cb95b4b76e04eb318d4cdfde65d714c6e51cd521be4e74e
55
2022-06-07 08:06:54
0
ffd83cae4880651833d26ccf874402b7eb4c4c393db20932cd49f4ecf26c075d
55
2022-06-07 08:06:54
3
ffbcb1ffd3b3cd1e6b0f0e579cb7645c8e09b4e4bc03e93cb0f068ab37712263
55
2022-06-07 07:57:14
20
cee035a6cb3d2e6d3680e2413beaaf8b514b952086a4637a90c113884f0bc847
54
2022-06-07 05:01:39
20
eefa6d4aa3e729adba1688cd737f78d5bdc7b62447165b5255541a962a246ddc
57
2022-06-07 05:00:19
11
ae2f202b69d15676baa77c4f1f16dda1d1f524172f99b06fe5a2dbb5f0f599e2
55
2022-06-07 03:30:18
1
42bd9efe6fa5a65e141f2f3d66aec4c588cd78292a30f3af57f1b24c6889eccf
55
2022-06-06 16:01:26
11
a600bcaa8701a3c32c42604d25d4ead9d74b9c2fa5aa34755bf5ffa0a32516dc
55
2022-06-06 12:20:34
24
1eedbbfd5b379e84f14fbd2b6e66e3f926ce293175445eb19bb661f78abd7a26
57
2022-06-06 11:10:30
0
f3f412987c463e077834fecbb9a0f19b3de393cf094b4736e2f7d9bd263d9894
57
2022-06-06 11:07:15
14
c0c9392b9334eea2cbe73485ee9c63f9e693908c3eb87f77b94a69eca394895d
56
2022-06-06 05:30:09
20
40049dbad1b57532db765877e792126779f8c2d93142d791540c5ec297747279
57
2022-06-06 03:54:48
22
2ae16b32705f145712aad85b551f1d00ebc6954840f7945ccf850091421bfce6
57
2022-06-06 01:15:26
19
e302ff011bbab714ee7bc4078bc8f8ac4fea0a8c7895feac55a04ac3f500ad1b
55
2022-06-05 00:39:11
11
c858774119e4bf466a3b001a1cb8a846ebe4b82327b2b3376d55749f2bbd9edd
56
2022-06-04 14:53:15
3
b631f6c8b38c1565b372b0af2b9c8589bf9cf91aa6f7c7f18e523a23662a788e
55
2022-06-04 05:14:56
13
2435f5bf0ecf3879794af79674320723316bc83ba910705d1ee7af2d6d818fba
56
2022-06-04 04:57:41
3
f4238d902824d716ac996c75896fbdfc560e716b860fadaa3271b1afe01445ef
57
2022-06-04 02:52:21
20
386ac13cdb3b309b528c6ce39be6b712b43f8b8922cd19e817ebbe70b67133f1
56
2022-06-03 23:31:33
4
47f96f9b888fa7bf3ccbcc29a4adb2d4bbdc14c5413dec572b14bc177fa31103
57
2022-06-03 22:46:45
18
d41220ea115cabb8f22d8f12c8bbc472494fedeaaae5789be7b6192438548143
56
2022-06-03 18:07:41
22
ce5671c292d834b04e0b27276c9b18c9f21da9d043b16ec2b3292ea5ff1b671c
58
2022-06-03 17:06:25
0
ca5857a3290ccd0a38aa27752e6f490e230f0cad7a650b0b146d99b59750ad18
58
2022-06-03 15:56:20
0
e3e4db45efab35e31cce8b6111475eac7a7d8e66842d58f905df5f94a4984fbb
57
2022-06-03 15:19:20
18
5385a798d136365b644199359dc2662de3b0d6c5adc09e4cf9cada074e8a9338
56
2022-06-03 12:15:40
2
85017c355f7544a8ec3676367cf01df2803c0a2dcac5f1b75a4db0e6b0de7e04
56
2022-06-03 09:48:52
15
8918ede0a38d40ee0b89028819dcaac6bb73d2280ad88ea2e1d0a42fd7101aa6
56
2022-06-03 08:02:02
1
4e03b26efbf9ed20c80319bc8a72d330c727a216e74c31cf97ccb5b85ab8f424
56
2022-06-03 07:50:30
17
57e73e139dff99884e9287266ca4caf826e7ec3b5e93f737198c6bf970b982f8
57
2022-06-03 07:34:33
17
6b817259bac271509241f40696a886584985b078f45923c50a056765f44d65b5
57
2022-06-03 07:07:02
23
8e986c906d0c6213f80d0224833913fa14bc4c15c047766a62f6329bfc0639bd
57
2022-06-02 20:51:51
12
983b6726492937b4ee915c9d98b9665ae86ace168eb903714a0622e5c014f7fd
57
2022-06-02 20:46:17
25
764a57c926711e448e68917e7db5caba988d3cdbc656b00cd3a6e88922c63837
58
2022-06-02 20:29:55
0
ee3a1ae5efb942500b6c81f4ddb682076d7ae2a805a47bda64297313fbb645a6
58
2022-06-02 20:08:12
24
fc2887c34e9bd5b5dc61ce389d0b28c25a57e9d2c8bc885a4b8b9527ce8dc7f7
58
2022-06-02 12:20:25
15
4f643bf57abe70e3c4ed64f05167da5d6c35f2dac1d7fda78523ab231f903575
56
2022-06-02 12:07:08
0
800a769983c44b7a6d21c746ffe1c5108b0e73d1a2a35a1691a9126eacb26bbe
55
2022-06-02 12:07:01

Rule Matches per Month (last 24 months)