Hex Encoded Eexecutable Creation

Rule Info

Name
Hex Encoded Eexecutable Creation
Author
X__Junior
Description
Detects creation of hex encoded executable piece by piece using commandline.
Reference
https://unit42.paloaltonetworks.com/espionage-campaign-targets-south-asian-entities/
Date
2025-02-04 00:00:00
Modified
None
Id
00e7e90b-85b5-46ae-842b-f9a4634dc450
Tags
attack.defense-evasion attack.t1070.004
Type
Nextron Sigma feed only (private)

Rule History

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022