Sunturai
Tool

gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f

https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
Published on
gist.github.com
Sources in this catalogue
2

ATT&CK techniques those detections carry

  • T1564.004NTFS File Attributes
  • T1112Modify Registry
  • T1012Query Registry
  • T1105Ingress Tool Transfer
  • T1218System Binary Proxy Execution
  • T1552.001Credentials In Files
Open the original

11 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
DetectionSeverity
Remote File Download Via Findstr.EXEMedium
Windows Alternate DataStream - Process ExecutionMedium
Windows Alternate DataStream - Base64 ContentMedium
Registry Modification Via Regini.EXELow
Suspicious Registry Modification From ADS Via Regini.EXEHigh
Imports Registry Key From an ADSHigh
Imports Registry Key From a FileMedium
Exports Registry Key To a FileLow
Exports Critical Registry Keys To a FileHigh
Insensitive Subfolder Search Via Findstr.EXELow
Exports Registry Key To an Alternate Data StreamHigh

Showing 11 of 11

Filter in the catalogue

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice