Anvilogic high experimental other

ATBroker.exe Execution [snowflake-crowdstrikefdr_process]

Helper binary for Assistive Technology (AT), Executes code defined in registry for a new AT. Modifications must be made to the system registry to either register or modify an existing Assistive Technology (AT) service entry. Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform = 'Win' and process_path ilike '%atbroker.exe' and regexp_like(process, '.*[^a-z]\\\/start[^a-z].*', 'i')

Field Validations

Loading…

Comments (0)

Loading comments...