4 ms·
Yara Rules Strings: Statistical Study
- brownbat 9y agoFascinating. I was curious which .exes were not just hijacked legit .exe names. The first .exe file that's not a normal windows executable is "mshtaex.exe" which seems to be a disguised (or possibly mistyped) version of the legitimate "mshta.exe". Mimikatz slips in the bottom of the list though. If someone's invoking mimikatz on your systems, that should stick out...