admin/manyfacedllama-amsi-tracer
1
0
Fork 0
mirror of https://github.com/manyfacedllama/amsi-tracer synced 2026-06-08 15:43:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix typo

Browse Source
This commit is contained in:
Erjan Kalybek
2020-11-01 02:30:27 +01:00
parent b0f4ef888b
commit 53585f048e
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1 -1
View File
@@ -13,7 +13,7 @@ AMSI is (originally) intended for application & AV vendors to interact with one
* Windows Management Instrumentation (WMI)
* ...
As malware (Windows) usually depend on one of these components within their execution chain, especially early on (e.g. downloader/dropper via maldoc), we can leverage this tool while dynamically analyzing a malware to unearth obfsucated code execution, dump assemblies that are dynamically loaded, and more.
As malware (Windows) usually depend on one of these components within their execution chain, especially early on (e.g. downloader/dropper via maldoc), we can leverage this tool while dynamically analyzing a malware to unearth obfuscated code execution, dump assemblies that are dynamically loaded, and more.
This tool is an alternative solution to using event tracing (ETW) to get AMSI events, which may be cumbersome and not easily integrable into automated pipelines (e.g. sandboxes).