Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Attackers Can Conceal Microsoft Defender Exclusions From PowerShell Queries
Malware Families
Excerpt
Microsoft Defender Antivirus allows administrators to create exclusions so that specific files, folders, processes, or IP addresses are not scanned. This is useful for trusted applications but dangerous if misused. Defender supports four main exclusion types: process, path, extension, and IP address. Path and extension exclusions are especially valuable to attackers because they can disable scanning on entire directories or file types, allowing malicious binaries to run…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | 3eb6f92aedf74f109c7b4b0897ec39a8 | High | Score 81/100 | First seen |
| MD5 | f6cb87781fae48a69b8052259fbcf6f1 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…