Skip to content

Instantly share code, notes, and snippets.

@mpgn

mpgn/ioc_check.ps1

Last active March 5, 2021 18:13
Show Gist options
  • Star 3 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save mpgn/ae512d933d65ae463d82c6297f8aac0e to your computer and use it in GitHub Desktop.
Save mpgn/ae512d933d65ae463d82c6297f8aac0e to your computer and use it in GitHub Desktop.
Download ZIP
Raw
ioc_check.ps1
# https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/
# https://twitter.com/richinseattle/status/1354296177743679489
# if true on powershell command or no error on reg query output you are infected !
reg query 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\KernelConfig'
reg query 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverConfig'
reg query 'HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SSL Update'
[System.IO.File]::Exists('C:\Windows\System32\Nwsapagent.sys')
[System.IO.File]::Exists('C:\Windows\System32\helpsvc.sys')
[System.IO.File]::Exists('C:\ProgramData\USOShared\uso.bin')
[System.IO.File]::Exists('C:\ProgramData\VirtualBox\update.bin')
[System.IO.File]::Exists('C:\ProgramData\VMware\vmnat-update.bin')
[System.IO.File]::Exists('c:\windows\system32\bcdbootinfo.tlp')
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment