Sysinternals
Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.
1,151 questions
Detecting ScareCrow and the like...
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(278.4, 28.000000000000004%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EC%3C/text%3E%3C/svg%3E)
CuriousHunter
1
Reputation point
In reading FireEye's recent blog on "Smoking out a DARKSIDE affiliate's supply chain software compromise" I followed the thread to one of the noted frameworks, ScareCrow. See github - optiv/ScareCrow .
In reviewing process hollowing and herpaderping, it appears that this attack vector (according to their claims) would go undetected. I haven't tested this in the lab, but am curious as to how SYSMON can be used to detect the actions.
Looking forward to the insights the community can bring to the forefront on this.
CuriousHunter
Sysinternals
Sign in to answer