![]() ![]() Process injection is a method of executing arbitrary code in the address space of a separate live process.įound a string that may be used as part of an injection methodĪdversaries may attempt to get a listing of open application windows.Īdversaries may target user email to collect sensitive information from a target.įound a potential E-Mail address in binary/memory Installs hooks/patches the running process Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources. ![]() Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Windows Management Instrumentation (WMI) is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components.įound a reference to a WMI query string known to be used for VM detection Adversaries may execute a binary, command, or script via a method that interacts with Windows services, such as the Service Control Manager.
0 Comments
Leave a Reply. |