@TheDFIRReport@infosec.exchange
2026-09-27 20:30 UTC
"The privilege escalation tool the threat actors brought with them was written as a text file and then decoded using certutil into a binary file."
Read the full report: https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver
#DFIR #ThreatIntel
Replies (1)
-
@taosecurity@infosec.exchange 2026-09-27 21:45
@TheDFIRReport@infosec.exchange I remember these tricks. I don’t remember if they used certutil before?