Provisioning package (.ppkg) dropped by non-servicing process (Sirius persistence

ills3c Intel&Coffee@Ills3C

•updated today•0•0•0

Detects the creation or modification of Windows provisioning packages (.ppkg) by processes other than expected provisioning and servicing tools. Attackers, such as those utilizing the Sirius Backdoor, can abuse custom .ppkg files to maintain persistence across OS resets.