MSC EvilTwin Exploit File Dropped

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the creation of .msc files in suspicious directories such as 'C:\Windows \System32', which could indicate an EvilTwin exploit (CVE-2025-26633) attempt. In this attack, the threat actor manipulates .msc files and the Multilingual User Interface Path (MUIPath) to execute malicious msc payload.

2025-03-27 00:00:00

None

f73cf795-33c2-4cd8-aa8a-cb1908ffce9f

attack.execution attack.t1204.002 cve.2025-26633

Nextron Sigma feed only (private)