Skip to content

Instantly share code, notes, and snippets.

@Shivammalaviya

Shivammalaviya/Detecting Purple Fox Malware Campaign

Created January 27, 2022 16:59
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save Shivammalaviya/f1fdf9c1aca87302a7257e38424f244f to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save Shivammalaviya/f1fdf9c1aca87302a7257e38424f244f to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Detecting Purple Fox Malware Campaign
DeviceFileEvents
| where ((InitiatingProcessFolderPath endswith @"\svchost.txt")
and FolderPath contains @"\Calldriver.exe"
and FolderPath contains @"\Driver.sys"
and FolderPath contains @"\dll.dll"
and FolderPath contains @"\kill.bat"
and FolderPath contains @"\speedmem2.hg")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment