Holy crap, I just traced an infection with Sysmon and the killchain was it trying to launch a .js file with PowerShell, but we remapped .JS to notepad.exe
Show this thread
-
A REAL-LIFE threat against a user, traced from inception with Sysmon (free), detected with PowerShell logging with Win7 WMF5 upgrade (free), ultimately defeated with simple defense-in-depth computer configuration in Group Policy (free).
@markrussinovich@jsnover@Lee_Holmespic.twitter.com/8yGOoPx8HB
Show this thread
This is Kovter, fileless malware - nice catch! Great read also by @kafeine on the gang behind it:https://www.proofpoint.com/us/threat-insight/post/kovter-group-malvertising-campaign-exposes-millions-potential-malware-and-fraud …
