yt0ng 6a014a3dc8 MSHTA spwaned by SVCHOST as seen in LethalHTA ...

"Furthermore it can be detected by an mshta.exe process spawned by svchost.exe."

2018-07-06 19:52:58 +02:00

..

builtin

High FP Rule

2018-06-29 16:01:46 +02:00

malware

Various rule fixes

2018-03-27 14:35:49 +02:00

other

Moved new rule to sysmon folder

2018-04-11 20:11:54 +02:00

powershell

Fixed bugs

2018-06-27 09:20:41 +02:00

sysmon

MSHTA spwaned by SVCHOST as seen in LethalHTA

2018-07-06 19:52:58 +02:00