nganhkhoa/mether049-malware
1
0
Fork 0
mirror of https://github.com/nganhkhoa/malware.git synced 2024-06-10 21:32:07 +07:00
Code Issues Projects Releases Wiki Activity

Update detecting_ph_process.md

Browse Source
This commit is contained in:
mether049 2020-03-01 03:43:34 +09:00 committed by GitHub
parent babf0fe8ba
commit 7538cc3398
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
detecting_ph_process.md
View File

@ -139,7 +139,7 @@ PS> eqllib query -f my-sysmon-data.json --source "Microsoft Sysmon" $eql | Conv
``` ```
eqllib query -f my-sysmon-data.json --source "Microsoft Sysmon" "process where pid=7356" eqllib query -f my-sysmon-data.json --source "Microsoft Sysmon" "process where pid=7356"
``` ```
![](https://github.com/mether049/malware/blob/master/Trickbot/img/Identification%20of%20Hollowed%20out%20processes/eql1.PNG) ![](https://github.com/mether049/malware/blob/master/Trickbot/img/Identification%20of%20Hollowed%20out%20processes/eql2.PNG?raw=true)
``` ```
eqllib query -f my-sysmon-data.json --source "Microsoft Sysmon" "process where pid=11228" eqllib query -f my-sysmon-data.json --source "Microsoft Sysmon" "process where pid=11228"