search

evild3ad / MemProcFS-Analyzer

MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR
https://lethal-forensics.com
GNU General Public License v3.0
462 stars 53 forks source link

Threat Detection #33

Closed sebastien5342 closed 6 months ago

sebastien5342 commented 7 months ago

During the script procedure, Microsoft Defender detected: backdoor:ASP/webshell.X. Everytime I ran the procedure, I got the same detection but the detection disappeared almost instantly after. I was wondering what was generating this alert??

evild3ad commented 6 months ago

It is better to disable Microsoft Defender AntiVirus temporarily or better exclude the MemProcFS-Analyzer directory from scanning. Microsoft Defender AntiVirus would slow down the analysis process and probably conflict with the ClamAV scan.

In my environment I manually disable tamper protection for the duration of memory analysis, so that MemProcFS-Analyzer.ps1 can disable Microsoft Defender AntiVirus temporarily (includes also AMSI). Works the best for me.

I expect it is a generic detection which I cannot avoid.