Skip to content
Threat Feed
Subscribe

Tag

File-Event

2 briefs RSS
high advisory

Detection of Legitimate Application File Writes to Suspicious Locations

Detection logic for identifying when known LOLBins write files to suspicious or uncommon directories to evade security controls.

stealth living-off-the-land windows file-event detection-engineering
1r 2t
medium advisory

Suspicious System Process Names in Unusual File Locations

This brief detects an attacker's attempt to evade detection and maintain persistence by creating executable files with names identical to legitimate Windows system processes in non-standard directories, a tactic associated with stealth and defense evasion.

stealth defense-evasion persistence windows file-event
1r 1t