attack.t1574.007 | Detection.FYI

Potential Suspicious Activity Using SeCEdit

Apr 28, 2026 · attack.collection attack.discovery attack.persistence attack.credential-access attack.privilege-escalation attack.execution attack.stealth attack.defense-impairment attack.t1685.001 attack.t1547.001 attack.t1505.005 attack.t1556.002 attack.t1685 attack.t1574.007 attack.t1564.002 attack.t1546.008 attack.t1546.007 attack.t1547.014 attack.t1547.010 attack.t1547.002 attack.t1557 attack.t1082 ·
Share on:

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

Read More
Trusted Path Bypass via Windows Directory Spoofing

Apr 28, 2026 · attack.persistence attack.privilege-escalation attack.execution attack.stealth attack.t1574.007 attack.t1548.002 ·
Share on:

Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification. This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.

Read More