Fallout in powershell, Aug 3 – Aug 9

What we caught this week while monitoring over 167,389,056 artifacts across 46 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

SUNDAY

Sun Aug 9 · 2 catches · 0 waves · 2 singles
micro-behaviors/communicationsmicro-behaviorsobjectives/credential-accessmicro-behaviors/datamicro-behaviors/fsmicro-behaviors/processmicro-behaviors/uimicro-behaviors/osmicro-behaviors/timeobjectives/command-and-controlobjectives+1 47d
DeskPilot 0.4.0 powershell 47 days ago

Base64 dropper executes payload

staging/embeddedstaging/encrypted
well-known/librarywell-knownmicro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/command-and-controlobjectives/anti-analysismetadata/buildmetadataobjectives/privilege-escalationobjectives+12 47d
PSPublishModule 3.0.103 powershell 47 days ago

Service binary path hijack

hijack-execution-flow/servicebuild/github-actions

THURSDAY

Thu Aug 6 · 1 catch · 0 waves · 1 single
well-known/libwell-knownmicro-behaviors/communicationsmicro-behaviorsmetadata/binarymetadataobjectives/command-and-controlobjectives/anti-analysisobjectives/anti-staticobjectivesobjectives/evasion+13 50d
Bicep 3.0.2-preview5 powershell 50 days ago

Embedded unsigned masquerading PE payload

masquerade/certobfuscation/binary-structure

WEDNESDAY

Wed Aug 5 · 1 catch · 0 waves · 1 single
micro-behaviors/communicationsmicro-behaviorsmalware/librarymetadata/buildmalwaremetadataobjectives/anti-analysisobjectives/evasionobjectives/anti-staticobjectivesobjectives/command-and-control+11 51d
PSPublishModule 3.0.98 powershell 51 days ago

Networked archive loader with process execution

delivery/download-executereflection/invoke
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories