huntrule

Malicious CACTUS Ransomware Deployment via TotalExec Script (via ps_script)

PremiumReviewedSigma · High · v1
Product
windows
Category
ps_script
Author
HuntRule
Published
2026-10-05
Updated
2026-10-05
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects PowerShell content referencing the TotalExec deployment script combined with PsExec, the automation CACTUS uses to push ransomware across hosts. TotalExec wraps PsExec to remotely execute the encryptor on many machines at once, enabling network-wide impact.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Malicious Shadow Copy Deletion via WMI PowerShell
Suspicious PowerShell Remote File Download Cmdlets (via ps_script)
Suspicious Bun Runtime Spawned by Node During npm Lifecycle
Malicious Office Application Spawning Command Interpreter
Suspicious PowerShell Encoded Command Execution
Suspicious Office Application Spawning Script Interpreter
Suspicious Microsoft Word Spawning PowerShell
Suspicious PowerShell Download Cradle Writing Executable To Windows Temp
Malicious IIS w3wp Worker Spawning Command Interpreter via SharePoint Web Shell
Malicious CACTUS Ransomware Deployment via TotalExec Script (via ps_script)
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.