search

ION28 / BLUESPAWN

An Active Defense and EDR software to empower Blue Teams
GNU General Public License v3.0
1.22k stars 169 forks source link

Added hunt for rover.dll persistence mechanism and fixed bug in registry detection comparison #413

Closed Jack-McDowell closed 2 years ago

Jack-McDowell commented 2 years ago

Right now, we won't detect rover.dll being added to system32, but added directory change notifications for system32 seems like a bit of a slippery slope into running a lot more hunts than we need. I propose fixing this be backlogged until we get proper event tracing set up.