CastleLoader - Named Pipe Shellcode Injection (T1055)
Correlates the Python loader process interacting with the hardcoded named pipe \pipe\PipePipe! used to buffer shellcode into memory.
Microsoft Sentinel (KQL)
Correlates the Python loader process interacting with the hardcoded named pipe \pipe\PipePipe! used to buffer shellcode into memory.
Already have an account?