attack.defense.evasion

Disabled AV On Dev Drive via Registry

Aug 10, 2024 · attack.defense.evasion attack.T1562.001 ·

Detects the execution registry change that enables a Dev Drive without allowing AV to access the created drive. This technique is available starting with Windows 11.

Enabling Dev Drive With Disabled AV

Aug 10, 2024 · attack.defense.evasion attack.T1562.001 ·

Share on:

Detects the execution of fsutil.exe to enable a Dev Drive with an argument that disables the AV on the created drive. This technique is available starting with Windows 11.

Execute Python Scripts via Python Installer Binary

Aug 10, 2024 · attack.Defense.Evasion attack.T1202 ·

Share on:

Detects the execution of malicious Python scripts from the AppData directory after the execution of the setup.exe installation package. Some installation packages allow for post-installation scripts to be run. A malicious actor could modify these scripts or add their own to execute malicious actions after the legitimate software is installed.