attack.t1059.006

Axios NPM Compromise Indicators - Linux

Apr 28, 2026 · attack.initial-access attack.t1195.002 attack.execution attack.command-and-control attack.t1059.006 attack.t1059.004 attack.t1105 detection.emerging-threats ·

Share on:

Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.

Python One-Liners with Base64 Decoding

Apr 28, 2026 · attack.execution attack.stealth attack.t1059.006 attack.t1027.010 ·

Share on:

Detects Python one-liners that use base64 decoding functions in command line executions. Malicious scripts or attackers often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.

Python One-Liners with Base64 Decoding - Linux

Apr 28, 2026 · attack.execution attack.stealth attack.t1059.006 attack.t1027.010 ·

Share on:

Detects the use of Python's base64 decoding functions in command line executions on Linux systems. Malicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.

AppLocker Prevented Application or Script from Running

Dec 24, 2025 · attack.execution attack.t1204.002 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.006 attack.t1059.007 ·

Share on:

Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.

Suspicious File Characteristics Due to Missing Fields

Nov 24, 2025 · attack.execution attack.t1059.006 ·

Share on:

Detects Executables in the Downloads folder without FileVersion,Description,Product,Company likely created with py2exe

Serpent Backdoor Payload Execution Via Scheduled Task

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.t1059.006 detection.emerging-threats ·

Share on:

Detects post exploitation execution technique of the Serpent backdoor. According to Proofpoint, one of the commands that the backdoor ran was via creating a temporary scheduled task using an unusual method. It creates a fictitious windows event and a trigger in which once the event is created, it executes the payload.

Emotet Loader Execution Via .LNK File

Jul 1, 2025 · attack.execution attack.t1059.006 detection.emerging-threats ·

Share on:

Detects the Emotet Epoch4 loader as reported by @malware_traffic back in 2022. The ".lnk" file was delivered via phishing campaign.

Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution

Sep 2, 2024 · attack.execution attack.initial-access attack.t1059.006 attack.t1190 cve.2022-22954 detection.emerging-threats ·

Share on:

Detects potential exploitation attempt of CVE-2022-22954, a remote code execution vulnerability in VMware Workspace ONE Access and Identity Manager. As reported by Morphisec, part of the attack chain, threat actors used PowerShell commands that executed as a child processes of the legitimate Tomcat "prunsrv.exe" process application.

Emotet loader execution via .lnk file

Aug 10, 2024 · attack.execution attack.T1059.006 ·

Share on:

Detects the latest emotet loader as reported by @malware_traffic. The .lnk file was delivered via phishing campaign.