Skip to content
Threat Feed
Subscribe

Tag

System-Binary-Proxy-Execution

2 briefs RSS
high advisory

Svchost LOLBAS Execution Process Spawn

This brief details the detection of `svchost.exe` spawning Living Off The Land Binaries and Scripts (LOLBAS) processes, indicating potential malicious code execution, privilege escalation, or persistence attempts by adversaries within a Windows environment.

Windows lolbas execution persistence lateral-movement system-binary-proxy-execution
1r 2t
medium advisory

Mshta Making Network Connections Indicative of Defense Evasion

Mshta.exe making outbound network connections may indicate adversarial activity, as it is often used to execute malicious scripts and evade detection by proxying execution of untrusted code.

Amazon Assistant +3 defense-evasion system-binary-proxy-execution windows
2r 1t