Skip to content

Instantly share code, notes, and snippets.

@Samirbous

Samirbous/detect xpertrat behavior

Created October 26, 2021 16:59
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Samirbous/3d9ed9b690936e2a3a5c5075f14e7bee to your computer and use it in GitHub Desktop.
Save Samirbous/3d9ed9b690936e2a3a5c5075f14e7bee to your computer and use it in GitHub Desktop.
Download ZIP
Raw
detect xpertrat behavior
process where event.action : "start" and
process.executable : "?:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" and
process.args_count <= 2 and process.args_count > 1 and
not process.args : "?:\\Program Files (x86)\\Internet Explorer\\iexplore.exe"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment