Kevin Wan
@Kevinwcs0 followers4 downloads16 copies2 likes289 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
1
1
1
1
1
Platforms
2
Products / Services
2
MITRE Techniques
2
1
1
1
1
Detects attempts to disable Windows Credential Guard by modifying the 'LsaCfgFlags' registry value. Credential Guard uses virtualization-based security to isolate secrets, and disabling it is a common defense evasion technique used by adversaries to access credentials for lateral movement.
Detects PowerShell execution patterns consistent with the 'FileFix' social engineering technique. This technique tricks users into pasting and running a malicious command, often from the Run dialog or File Explorer address bar, which results in explorer.exe being the parent process. The command typically involves downloading and executing a remote script.