5 skills · sorted by relevance
Detect attacks that misuse legitimate Windows utilities such as certutil and mshta. Analyze process logs, command arguments, and parent-child relationships with Sigma detection rules, then report suspicious events with severity scores and supporting event details.
Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and parent-child process analysis
The English summary is being prepared. Showing the original description.
Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and parent-child process analysis
The English summary is being prepared. Showing the original description.
Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and parent-child process analysis
The English summary is being prepared. Showing the original description.
Utilize the native Windows binary `certutil.exe` to download malicious payloads and optionally decode Base64 encoded files as a Living-off-the-Land (LotL) technique. This skill details how attackers bypass application whitelisting and fetch stage-2 implants.
The English summary is being prepared. Showing the original description.