GoGRPC hidden execution log creation under ProgramData\appscreen
Detects creation of the appscreen.log file under %PROGRAMDATA%\appscreen, an artifact used by GoGRPC backdoor variants to track malware execution activity.
Microsoft Sentinel (KQL)
Detects creation of the appscreen.log file under %PROGRAMDATA%\appscreen, an artifact used by GoGRPC backdoor variants to track malware execution activity.
Already have an account?