MITRE ATT&CK T1547 Detection Rules | Fibratus

Reglas de detección de Fibratus mapeadas a la técnica T1547 de MITRE ATT&CK. Cobertura basada en comportamiento a nivel de kernel.

Volver a todas las reglas

Reglas en esta categoría

• Network connection via startup folder executable or script
• Potential mandatory profile registry persistence
• Potential port monitor or print processor persistence via registry modification
• RID Hijacking
• Script interpreter host or untrusted process persistence
• Suspicious persistence via registry modification
• Suspicious port monitor loaded
• Suspicious print processor loaded
• Suspicious Startup shell folder modification
• Unusual file written in Startup folder
• Unusual process modified registry run key