Add plugin for Image File Execution Options

fox-it / dissect.target

The Dissect module tying all other Dissect modules together. It provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets).

GNU Affero General Public License v3.0

44 stars 44 forks source link

Add plugin for Image File Execution Options #617

Open DissectBot opened 6 months ago

DissectBot commented 6 months ago


HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*

Values:

MonitorProcess
Debugger

hxxps://pentestlab.blog/2020/01/13/persistence-image-file-execution-options-injection/