1
0
Форкнуть 0

Update evasive-powershell-executions.md

This commit is contained in:
Elif Kaya 2021-08-17 16:58:39 -07:00 коммит произвёл GitHub
Родитель 2ff4cde36b
Коммит 254f91e187
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: 4AEE18F83AFDEB23
1 изменённых файлов: 3 добавлений и 0 удалений

Просмотреть файл

@ -1,3 +1,6 @@
# Jupyter AKA SolarMarker
Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for it's info-stealing and backdoor capabilities that mainly proliferates through search engine optimization manipulation and malicious advertising in order to successfully encourage users to download malicious templates and documents. This malware has been popular since 2020 and currently is still active as of 2021.
# Jupyter's evasive PowerShell executions
The following query checks for instances of Jupyter or SolarMarker malware that launch a lengthy PowerShell script, which in turn reads from encoded strings to parse the next malicious script. The initiating process name for this will almost always end in ".tmp" and reflect the original downloaded executable name.