OTRF / detection-hackathon-apt29

Place for resources used during the Mordor Detection hackathon event featuring APT29 ATT&CK evals datasets
GNU General Public License v3.0
130 stars 41 forks source link

17.C) Data Compressed, Obfuscated Files or Information #42

Open Cyb3rWard0g opened 4 years ago

Cyb3rWard0g commented 4 years ago

Description

The staged file is compressed (T1002) as well as prepended with the magic bytes of the GIF file type (T1027).