[New WTFBin]: Network Detective Data Collector

mttaggart / wtfbins

WTF are these binaries doing?! A list of benign applications that mimic malicious behavior.

MIT License

142 stars 10 forks source link

Closed Purp1eW0lf closed 2 years ago

Purp1eW0lf commented 2 years ago

Contributor Name: Dray Agha @purp1ew0lf
Application/Executable: Network Detective Data Collector (nddc.exe)
WTF Behavior Description: The executable for Network Detective Data Collector displays false positive activity similar to Impacket's WMI/SMBexec
Link to Documentation of Behavior: It's a Rapid Fire Tools / Kaseya bit of tooling. Unfortunately I can't find specific section of documentation that explains the context of this activity.

mttaggart commented 2 years ago

Thank you for the submission!

Added in 95516e5.

HuskyHacks commented 2 years ago

sus AF, if I saw that in my logs I'd break out the flamethrower. Great WTFBin!