.NET Loader - NVIDEO Deep AppData Staging (T1036.005)
Employs regex to identify the highly specific, deceptive, deeply nested directory structure (LocalLow Windows\Program Rules NVIDEO) used to hide the persistent payload.
Microsoft Sentinel (KQL)
Employs regex to identify the highly specific, deceptive, deeply nested directory structure (LocalLow Windows\Program Rules NVIDEO) used to hide the persistent payload.
Already have an account?