"BBRegSys::GetRegSysLicenceParameters" (Indicator: "regsys") "BBRegSys::VerifyLicenceSignatureAndOtherParameters" (Indicator: "regsys") "BBRegSys::VerifyLicencePublicKeyFromXmlToBlob" (Indicator: "regsys") "BBRegSys::GetFBELicenceFileName" (Indicator: "regsys") "BBRegSys::GetOldLicenceFileName" (Indicator: "regsys") "BBRegSys::GetLicenceFileName" (Indicator: "regsys") "BBRegSys::GetLicencesPath" (Indicator: "regsys") "File Monitor -" (Indicator: "file monitor") "TRegSysLinkedLicence" (Indicator: "regsys") "TRegSysLinkedLicence *" (Indicator: "regsys") "System::DelphiInterface" (Indicator: "regsys") "std::_Vector_val >" (Indicator: "regsys")
Reads terminal service related keys (often RDP related)Īdversaries may target user email to collect sensitive information from a target. Remote desktop is a common feature in operating systems. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.Ĭontains ability to query the machine timezoneĪdversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Ĭhecks a device property (often used to detect VM artifacts)Īdversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.Īn adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. The input sample is signed with a certificate
Process injection is a method of executing arbitrary code in the address space of a separate live process.įound a string that may be used as part of an injection methodĬode signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand.Ĭontains ability to enumerate processes/modules/threads
0 kommentar(er)
