Rule Info
Name
SUSP_Small_Downloader_Script_Aug26_3
Author
Florian Roth
Description
Detects small shell scripts that use command-line download utilities, encoding/decoding utilities, and temporary-directory staging, potentially indicating payload download and execution activity
Score
60
Reference
Internal Research
Date
2026-08-27
Modified
2026-08-31
Minimum Yara
3.5.0
Rule Hash
f87773ac80b4c88a03dceb8c70e322d2
Tags
['SCRIPT', 'FILE', 'T1105', 'SUSP']
Required Modules
[]
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
1
Suspicious (< 10 engines)
1
Clean (0 engines)
12
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR