huntrule

Malicious PowerShell Spawned by Masqueraded NVIDIA GeForce Experience Binary

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-14
Updated
2026-09-14
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects PowerShell spawned by a process named nvidia geforce experience.exe, a masquerade the Genesis Market campaign used to sideload LummaStealer from a legitimately named binary. The genuine GeForce Experience application does not launch PowerShell, so this chain indicates DLL sideloading and stealer execution.

Reporting behind it

Related detections9 linkedT1574.001 — drag to rearrange
Malicious Bumblebee DLL Sideload of msimg32 by consent from Non-System Path (via image_load)
Suspicious PsExec Service Launching Encoded PowerShell Payload
Suspicious PowerShell Remote Script Execution via IEX DownloadString
Suspicious BugSplat Binary Sideloading bugsplatrc.dll via DLL Search Order Hijack
Suspicious SentinelOne Binary Sideloading sentinelagentcore.dll
Suspicious 7-Zip Executable Sideloading 7z.dll Loader
Suspicious Loading of Masqueraded EndpointDlp.dll Backdoor
Suspicious Trend Micro Binary Sideloading tmdglog.dll
Malicious SharePoint ToolShell Post-Exploitation via Encoded PowerShell (via process_creation)
Malicious PowerShell Spawned by Masqueraded NVIDIA GeForce Experience Binary
Pivot detection · T1574.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.