attack.g0032 | Detection.FYI

Lazarus APT DLL Sideloading Activity

Sep 2, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 attack.g0032 detection.emerging-threats ·
Share on:

Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company

Read More
Lazarus Group Activity

Aug 12, 2024 · attack.g0032 attack.execution attack.t1059 detection.emerging-threats ·
Share on:

Detects different process execution behaviors as described in various threat reports on Lazarus group activity

Read More
Suspicious HWP Sub Processes

Aug 12, 2024 · attack.initial-access attack.t1566.001 attack.execution attack.t1203 attack.t1059.003 attack.g0032 ·
Share on:

Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation

Read More