Anvilogic high experimental other

Logon Script Registry Key added [snowflake-crowdstrikefdr_process]

Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence.

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform = 'Win' and process_path ilike '%\\\reg.exe' and process ilike '%add%' and process ilike '%UserInitMprLogonScript%'

Field Validations

Loading…

Comments (0)

Loading comments...