Skip to content

Instantly share code, notes, and snippets.

@Shivammalaviya

Shivammalaviya/New Emotet Behavior detection

Created January 25, 2022 16:32
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save Shivammalaviya/99628f6e8811ec319aaa2a509160e341 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save Shivammalaviya/99628f6e8811ec319aaa2a509160e341 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
New Emotet Behavior detection
DeviceProcessEvents
| where (ProcessCommandLine contains "sun.ocx"
and ProcessCommandLine contains "DllRegisterServer"
and (FolderPath endswith @"\rundll32.exe"))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment