attack.t1055.012 | Detection.FYI

HackTool - CACTUSTORCH Remote Thread Creation
May 5, 2023 · attack.defense_evasion attack.execution attack.t1055.012 attack.t1059.005 attack.t1059.007 attack.t1218.005 ·
Share on:
Detects remote thread creation from CACTUSTORCH as described in references.

Read More
Sysmon Process Hollowing Detection
Jan 3, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055.012 ·
Share on:
Detects when a memory process image does not match the disk image, indicative of process hollowing.

Read More