Discover and read the best of Twitter Threads about #GRUNT
Most recents (1)
#InstallUtil payloads are still very popular for code execution and app whitelisting bypass.
Here's a fresh sample with a #GRUNT payload: "compliancesignature.cs"
MD5: f55c0c165f30df6d92fbb50bf7688dc5
virustotal.com/gui/file/1db94…
0/59 static detections.
So I'll share some rules!
👇👇
Here's a fresh sample with a #GRUNT payload: "compliancesignature.cs"
MD5: f55c0c165f30df6d92fbb50bf7688dc5
virustotal.com/gui/file/1db94…
0/59 static detections.
So I'll share some rules!
👇👇
Identify suspicious #InstallUtil code execution payloads with a syntax-based #Yara rule (gist.github.com/itsreallynick/…) from this thread () on a *pretty damn similar* sample 🧐
Also look closely at both samples' embedded PE information (Original/InternalName) 😉
Also look closely at both samples' embedded PE information (Original/InternalName) 😉
