Anvilogic high experimental other

Attrib.exe Metasploit File Dropper [snowflake-crowdstrikefdr_process]

Using attrib.exe, an adversary may display or change file attributes in order to bypass UAC restrictions. Metasploits file_dropper.rb, which is include in some payloads uses this to assist in removing artifacts. -- Software Association: TargetCompany

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform = 'Win' and regexp_like(process, '.*(attrib.+?\.dll).*', 'i')

Field Validations

Loading…

Comments (0)

Loading comments...