Detects DonutLoader

Family: DonutLoader

DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

Detect binaries embedding considerable number of MFA browser extension IDs.

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Boot or Logon Autostart Execution: Active Setup

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

Command and Scripting Interpreter: PowerShell

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

Command and Scripting Interpreter: PowerShell

Using powershell.exe command.