Armorsteal got.py ChromElevator download and execution from SystemHealth

ills3c Intel&Coffee@Ills3C

•updated 3 days ago•2•0•4

Detects a sequence where a Python process connects to GitHub to retrieve files associated with Armorsteal/got.py, followed by the execution of a 'chromelevator' binary from the C:\Windows\SystemHealth\Update\getthem directory within a 30-minute window.