==================================================

CREATED: WIN-REPLACE-WRITE-PE (#1235)

Description

Identifies instances of the Windows replace.exe utility used to initiate a WebDAV binary download.

References

ATT&CK Technique T1105

==================================================

CREATED: WIN-PRINT-WRITE-PE (#1236)

Description

Identifies instances of the Windows print.exe utility used to initiate a WebDAV binary download.

References

ATT&CK Technique T1105

Did this answer your question?