Comments (2)
wietze
commented on May 29, 2024
1
The Microsoft blog linked to in the Security Intelligence article suggests a decrypted DLL is injected into a new userinit.exe instance. This does not meet the criteria for LOLBAS.
The registry key value userinit as described in step 4 of your Trend Micro link is one of the many Windows autostart locations, which in this modified by the backdoor (seems unrelated to Astaroth). This is not within LOLBAS's scope.
from lolbas.
Ryan-OKeeffe
commented on May 29, 2024
I see, thanks for the response and sorry for wasting time!
from lolbas.
Related Issues (20)
- yamllint GitHub Action HOT 1
- Schema Checking HOT 1
- Workflow Order
- Error in description of Explorer.exe entry
- Using certreq.exe to create admin certificate bypassing certification authority service
- 5 more Microsoft 'exploitable' opportunities HOT 1
- Suggestion / Request - Fileserver Resource Manager
- Update Odbcconf content + link
- Suggestion: Generate detections as a single, machine-parsable file? HOT 3
- Sigma rules attached for detection are redirecting to an old and outdated branch HOT 1
- Add Curl as LOLBIN HOT 1
- add msedge_proxy.exe
- winrs.exe - Probably should be on this list? HOT 1
- closed
- Removal of CertReq -Post as LOLBAS HOT 2
- Typo on website HOT 1
- Add tag to INetCache downloaders HOT 1
- Incorrect day / month placement in testwindowremoteagent.yaml
- Adding Powershell.exe to the list of LOLBins HOT 3
- Add a "related parameters" and/or "related switches" option to LOLBAS entries
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from lolbas.