ThugLyfe Threat Hunt Notes
net accounts
Suspicious Accounts:
- Administators
- SYSTEM_SERVICE
Get-ScheduledTask
Investigate Scheduled Tasks with no task path
The task was created not too long ago
When it triggers it calls an unknown svchost.exe
Get-ChildItem -Path c:\users\public -file -recurse
Investigate suspicious files
svchost.exe from suspicious task
SecurityUpdate is a hidden folder
Event Viewer Registry Key Changes
To work on next:
- Event Viewer for Registry Key
- Report on sus files