c1bba723f79282dceed4b8c40123c72a5dfcf4e3ff7dd48db8cb6c8772b60b88SHA-256 hash
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 2 years ago
What the reports say
1 report, newest first · the exact sentence from each-
GrimResource - Microsoft Management Console for initial access and evasion“| c1bba723f79282dceed4b8c40123c72a5dfcf4e3ff7dd48db8cb6c8772b60b88 | SHA-256 | N/A | Cobalt Strike payload |”
Indicators reported together
named in the same reports- process.ext.api.parameters[.]protectionin 1 report
- 14bcb7196143fd2b…6b53310258bbin 1 report
- 4cb575bc114d39f8…44cd99087fd7in 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.