Last Updated: 2018-05-07 01:08:59 UTC
by Guy Bruneau (Version: 1)
A few days ago I started seeing in my honeypot traffic attempting to use PowerShell to download a php script as a test. The script might look like this.
Using Cyberchef, I decoder the base64 URL but the php script was no longer available.
Have you seen a similar query in your logs? We would be interested in getting a copy of the php script.You can use our contact page to submit a copy.