process[.]peDomain
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 3 years ago
What the reports say
6 reports, newest first · the exact sentence from each-
Exploring Windows UAC Bypasses: Techniques and Detection Strategies“process[.]pe.original_file_name :”
-
SiestaGraph: New implant uncovered in ASEAN member foreign ministry“process[.]pe.original_file_name : "windowss.exe" and not process.name : "windowss.exe" and process.parent.args : "Schedule"”
-
Operation Bleeding Bear“process[.]pe.original_file_name == "AdvancedRun.exe" and”
-
Doing time with the YIPPHB dropper“intrusion_detection where (process[.]pe.original_file_name == "PowerShell.EXE" and process.command_line like "*Unicode.GetString*" and process.args like "*replace*")”
-
LUNA Ransomware Attack Pattern Analysis“process[.]pe.original_file_name : ("net.exe", "sc.exe", "cmd.exe") and”
-
Elastic Security uncovers BLISTER malware campaign“(process[.]pe.original_file_name == "RUNDLL32.EXE" and not process.name : "RUNDLL32.EXE")”
Indicators reported together
named in the same reports- hxxps://github[.]com/hfiref0x/UACMEin 1 report
- hxxps://swapcontext.blogspot[.]com/2020/10/uacme-35-wd-and-ways-of-mitigation.htmlin 1 report
- swapcontext.blogspot[.]comin 1 report
- hxxps://tyranidslair.blogspot[.]no/2017/05/reading-your-way-around-uac-part-1.htmlin 1 report
- tyranidslair.blogspot[.]noin 1 report
- hxxps://tyranidslair.blogspot[.]no/2017/05/reading-your-way-around-uac-part-2.htmlin 1 report
- hxxps://tyranidslair.blogspot[.]no/2017/05/reading-your-way-around-uac-part-3.htmlin 1 report
- hxxps://www.tiraniddo[.]dev/2017/05/exploiting-environment-variables-in.htmlin 1 report
- www.tiraniddo[.]devin 1 report
- hxxps://medium[.]com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6ein 1 report
Copy these 10 indicators · defanged
Thanks — we review every report.