TGI HUNT PowerShell Execution String Base64 Encoded New-Object (V3LU9)
Sourcetgreen/hunting
CreatedJanuary 1, 2001
UpdatedNovember 30, 2023
Classificationattempted-admin
alert ip any any -> $HOME_NET any (msg:"TGI HUNT PowerShell Execution String Base64 Encoded New-Object (V3LU9)"; flow:established; app-layer-protocol:!tls; content:"V3LU9"; distance:0; content:!" TlRMT"; reference:url,github.com/no0be/DNSlivery; threshold:type limit, track by_src, seconds 60, count 1; metadata:created_at 2001_01_01, updated_at 2023_11_30; classtype:attempted-admin; sid:2610498; rev:3;)
References
Metadata
created at2001_01_01
updated at2023_11_30
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!