Detects the deletion of scheduled tasks related to Windows Defender.

Read More

Detecting the registry change that would prevent any warnings or alerts when Python functions are about to be executed. Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.

Read More

Detects the execution of reg.exe and subsequent command line arguments for enabling RDP service on the host

Read More

Detects the registry modification to enable restricted admin mode using reg.exe

Read More

Detecting the execution of hh.exe and the follow up activity for downloading or executing second stage payloads. This is based malspam activity delivering Remote Access Trojans via initial .chm payloads.

Read More

Detects the use reg.exe to hide users from listed in the logon screen. This is possible by changing the registry key value to 0 for a specific user.

Read More

Detects attempts to disable AMSI in the commandline. It is possible to bypass AMSI by disabling it before loading the main payload.

Read More

Detects the creation of a schtask that executes a base64 encoded payload stored in the Windows Registry using PowerShell.

Read More

Detects emojis in the command line

Read More

Detects the initial execution of cmd.exe which spawns explorer.exe with the appropriate command line arguments for opening the My Computer folder.

Read More

Detects the use of lazagne looking into the command line execution.

Read More

Detects the execution of a specific OneLiner to download and execute powershell modules in memory.

Read More