admin/0xHossam-ShellHWEventExec
1
0
Fork 0
mirror of https://github.com/0xHossam/ShellHWEventExec synced 2026-06-21 19:40:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

add resources

Browse Source
This commit is contained in:
Hossam Ehab
2026-06-21 00:34:56 +03:00
committed by GitHub
parent 387b14d7f5
commit 310f5ddcbc
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+10
View File
@@ -96,3 +96,13 @@ That rule is scoped to Comodo-specific behavior, not the direct PTY execution pa
## detection
Elastic will probably cover this in a day.
--
## resources
* [https://learn.microsoft.com/en-us/windows/win32/api/shobjidl/nf-shobjidl-ihweventhandler-initialize](https://learn.microsoft.com/en-us/windows/win32/api/shobjidl/nf-shobjidl-ihweventhandler-initialize)
* [https://learn.microsoft.com/en-us/windows/win32/shell/how-to-register-a-handler-for-a-device-event](https://learn.microsoft.com/en-us/windows/win32/shell/how-to-register-a-handler-for-a-device-event)
* [https://lolbas-project.github.io/lolbas/Libraries/Shell32/](https://lolbas-project.github.io/lolbas/Libraries/Shell32/)
* [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/)
* [https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_comodo_ssh_shellhost_cmd_spawn/](https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_comodo_ssh_shellhost_cmd_spawn/)