Dirty Wizard
@DirtyWizard4040 followers9 downloads33 copies2 likes393 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
1
1
1
Platforms
2
Products / Services
1
MITRE Techniques
1
1
1
1
1
CVEs
1
Detects suspicious registry writes that change the BitLocker BDEUILauncher CLSID {A7A63E5C-3877-4840-8727-C1EA9D7A4D50} InProcServer32 DLL away from fveui.dll, consistent with BitlockMove-style COM/DCOM hijacking lateral movement.
Detects probable exploitation of the reported Notepad++ plugin DLL hijack by correlating DLL loads from Notepad++\plugins with recent file changes or swap-style renames, prioritising user-writable locations (Users/AppData/OneDrive) and weak trust. Outputs a Verdict and SuspicionScore for quick triage.