attack.t1574.013 | Detection.FYI

PowerShell Suspicious .NET Methods

Mar 26, 2024 · attack.defense_evasion attack.t1140 attack.t1574 attack.t1574.013 ·
Share on:

Detects the loading of suspicious .NET methods, seen in PowerShell script load content. This behavior is not limited to Yellow Cockatoo and can be applied universally for malicious PowerShell obfuscation attempts. Part of the RedCanary 2024 Threat Detection Report.

Read More