Windows registry artifactPowerShell Info
Cobalt Strike Reflection Attack - Lockbit 2.0
- Threat Hunting
- 1 key
SOFTWARE
Registry keys
1 key that RECmd reads for this artifact
SOFTWAREMicrosoft\PowerShell\infoCobalt Strike Reflection Attack - Lockbit 2.0
References
4 links
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)