Potentially Suspicious PowerShell Script With Decompression And Download Capabilities Executed

Nasreddine Bencherchali (Nextron Systems)

Detects the execution of a potentially suspicious PowerShell script that contains references to "Download", "Decompression" and "Execution" cmdlets along with suspicious paths and file sharing websites. Threat actors were seen leveraging PowerShell scripts that download a compressed malicious payload from a file sharing domain such as "anonfiles" or some CDN hosting platform. Then decompressing and storing the payload in an unusual location such as "Temp" directories" and then executing it everything.

2024-06-06 00:00:00

None

387e16a3-ed06-4ecb-9b9c-7dae0d067440

attack.defense_evasion attack.t1140

Nextron Sigma feed only (private)