process.ext.api.parameters[.]protectionDomain
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 17 months ago
What the reports say
3 reports, newest first · the exact sentence from each-
Misbehaving Modalities: Detecting Tools, Not Techniques“not (process.Ext.api.name == "VirtualProtect" and process.Ext.api.parameters[.]protection == "RWX" and process.Ext.api.parameters.protection_old == "RWX") and”
-
GrimResource - Microsoft Management Console for initial access and evasion“process.Ext.api.parameters[.]protection == "RWX" and”
-
Doubling Down: Detecting In-Memory Threats with Kernel ETW Call Stacks“process.Ext.api.parameters[.]protection : "*W*") or”
Indicators reported together
named in the same reports- hxxps://raw.githubusercontent[.]com/S3cur3Th1sSh1t/Get-System-Techniques/master/TokenManipulation/Get-WinlogonTokenSystem.ps1in 1 report
- 707564fc98c58247…158eb5704df4in 1 report
- 14bcb7196143fd2b…6b53310258bbin 1 report
- 4cb575bc114d39f8…44cd99087fd7in 1 report
- c1bba723f79282dc…6c8772b60b88in 1 report
Copy these 5 indicators · defanged
Thanks — we review every report.