Anvilogic high experimental other

Certutil Obfuscate_Encode Files [snowflake-crowdstrikefdr_process]

Certutil can be used to encode files to evade defensive measures. -- Threat Actor Association: APT29/Nobelium/Cozy Bear, Arid Viper/APT C-23, BlackTech - Software Association: Conti

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform = 'Win' and ((process ilike '%certutil.exe' and (process ilike '%\-encode%' or process ilike '%\-encodehex')) or regexp_like(process_path, '.*[^a-z]\\\-encode[^a-z].*', 'i'))

Field Validations

Loading…

Comments (0)

Loading comments...