Tag
bitcoinj ScriptExecution P2PKH/P2WPKH Verification Bypass
2 rulesA vulnerability in bitcoinj's ScriptExecution.correctlySpends() allows attackers to bypass signature verification for P2PKH and P2WPKH spends, potentially leading to unauthorized transaction validation.
Crowdstrike RTR Script Execution via PowerShell
2 rules 1 TTPDetection of PowerShell execution initiated via Crowdstrike Real Time Response (RTR) 'runscript' command, potentially indicating malicious actors leveraging compromised Crowdstrike Dashboard access to execute commands on remote hosts using encoded commands.
Script Execution via Microsoft HTML Application
3 rules 1 TTPDetects the execution of scripts via HTML applications using Windows utilities rundll32.exe or mshta.exe to bypass defenses by proxying execution of malicious content with signed binaries.
Suspicious Script Interpreter Execution from Environment Variable Folders
2 rules 1 TTPMalware may execute scripts from suspicious directories accessible via environment variables using script interpreters like cscript, wscript, mshta, and powershell to evade detection.