João Pedro Rosa
@akajhon0 followers40 downloads5 copies7 likes81 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
Platforms
1
MITRE Techniques
1
1
1
1
1
Detects potential AppDomainManager hijacking used by the OneClik APT campaign, where legitimate .NET ClickOnce applications (ZSATray.exe, umt.exe, ied.exe) load a suspicious DLL like 'history.tlb'. This technique (T1574.014) is used to load attacker-controlled assemblies and execute malicious code.
