SCNotification.exe Loading Unsigned DLL (AppDomainManager Hijack via CcmExec)

ills3c Intel&Coffee@Ills3C

•updated 14 days ago•1•0•3

Detects the execution of the SCCM/Configuration Manager notification utility (SCNotification.exe) when it is unsigned or has an invalid/expired signature, excluding standard loaded modules from .NET and assembly directories.