iiinova — where your digital self keeps evolving

securityaura.bsky.social

@securityaura.bsky.social

423 followers 205 following 126 posts

GCIH, GCFE | DFIR, Threat Hunting, Detection Engineering | @CuratedIntel DFIR Member SecurityAura.com infosec.exchange/@SecurityAura

Posts Replies Media

securityaura.bsky.social @securityaura.bsky.social · 10/02/2025

#100DaysOfKQL Day 40 - ClickFix - PowerShell Command Launched via Windows Run Box A campaign/social engineering specific query for ClickFix using our knowledge of Windows Registry forensics! Ah, Defender also picks it up anyway!😂 github.com/SecurityAura...

010

securityaura.bsky.social @securityaura.bsky.social · 21/01/2025

Confirmed with NetExec 1.3.0 and Impacket 0.12.0.dev1 that the new path is indeed: C\:\\Windows\\Temp\\[a-zA-Z0-9]{8}.tmp Good news? Detected by Microsoft Defender by default: And another detection: Behavior:Win32/RegDump.SA.

041