service_control_manager | Detection.FYI

Disable Windows Defender via Service

Feb 26, 2024 · attack.execution attack.t1569.002 attack.t1562.001 dist.public ·
Share on:

Detects Windows Defender disabling service installation

Read More
QBot scheduled task REGSVR32 with C$ image path

Feb 23, 2024 · attack.persistence attack.privilege_escalation attack.t1053.005 ·
Share on:

Detects the creation of Scheduled Task with REGSVR32 (regsvr32.exe) and C$ in the image path field

Read More