Discover and read the best of Twitter Threads about #t1036
Most recents (1)
🦖Day 14 of the @velocidex #velociraptor #ArtifactsOfAutumn series
Artifact: 'Windows[.]Detection[.]BinaryRename'
Author: @mgreen27
Link: docs.velociraptor.app/exchange/artif…
Artifact: 'Windows[.]Detection[.]BinaryRename'
Author: @mgreen27
Link: docs.velociraptor.app/exchange/artif…
This artifact will detect renamed binaries commonly abused by adversaries.
Renaming binaries is a defense evasion technique used to bypass brittle process name and path-based detections. It is used by many actors/groups, including from commodity malware and nation states.
Renaming binaries is a defense evasion technique used to bypass brittle process name and path-based detections. It is used by many actors/groups, including from commodity malware and nation states.
Here, we can see 'cmd.exe' was renamed in an attempt to appear as a legitimate instance of 'lsass.exe':
