Joe Security
@joesecurity1 follower4,321 downloads3 copies0 likes832 views
112 detections
Filters
Last updated
All Time
Detection languages
112
Categories
89
3
Platforms
112
Products / Services
20
MITRE Techniques
10
6
3
3
2
Execute DLL with spoofed extension
EQNEDT32.EXE connecting to internet
Drops script at startup location
Delete shadow copy via WMIC
uses findstr.exe to decode strings from lnk file
Decode DLL Via Certutil
Credwiz util dropped by mshta for dll sideloading
Copy file to startup via Powershell
Check privilege of CMD via whoami
Check external IP via Powershell
Page 11 of 12